CVE Intelligence

Designthemes vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Designthemes products: 34 record(s), with severity, exploitation and fixes.

DesignThemes LMS 3WeDesignTech Ultimate Booking Addon 2Reservation Plugin 2Knowledge Base 1HomeFix Elementor Portfolio 1DesignThemes Portfolio Addon 1WeDesignTech Portfolio 1DesignThemes Core 1DesignThemes LMS Addon 1Triss 1VEDA 1Single Property 1Kriya 1Trendy Travel 1SpaLab | Beauty Salon WordPress Theme 1Kids Zone - Children WordPress Theme 1Kids Life | Children School WordPress 1Fitness Zone WordPress Theme 1DesignThemes Core Features 1OneLife 1Vivagh 1Kids Heaven 1Solar Energy 1Insurance 1Whistle - Sports Club 1LMS Elementor Pro 1DesignThemes Booking Manager 1DesignThemes Directory Addon 1DesignThemes Portfolio 1Dental Clinic 1

Exploited only (KEV) →

CVE-2026-78532 High · 7.1 CWE-79 Oct 10, 2026
WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
CVE-2026-94061 High · 7.1 CWE-79 Oct 9, 2026
WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflected XSS.This issue affects Whistle - Sports Club: from n/a through 4.2.
CVE-2026-27404 High · 7.1 CWE-79 Jul 2, 2026
WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.
CVE-2026-27402 High · 7.1 CWE-79 Jul 2, 2026
WordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.
CVE-2025-69156 High · 7.1 CWE-79 Jul 2, 2026
WordPress Kids Zone - Children WordPress Theme theme <= 5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions.
CVE-2025-69155 High · 7.1 CWE-79 Jul 2, 2026
WordPress Fitness Zone WordPress Theme theme <= 5.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.
CVE-2025-69154 High · 7.1 CWE-79 Jul 2, 2026
WordPress SpaLab | Beauty Salon WordPress Theme theme <= 6.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions.
CVE-2025-69153 High · 7.1 CWE-79 Jul 2, 2026
WordPress Trendy Travel theme <= 6.7 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.
CVE-2026-27983 Critical · 9.8 CWE-266 Mar 5, 2026
WordPress LMS Elementor Pro plugin <= 1.0.4 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor Pro: from n/a through <= 1.0.4.
CVE-2026-27390 High · 8.8 CWE-288 Mar 5, 2026
WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.
CVE-2026-27389 Critical · 9.8 CWE-288 Mar 5, 2026
WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.
CVE-2026-27388 High · 7.5 CWE-862 Mar 5, 2026
WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Booking Manager: from n/a through <= 2.0.
CVE-2026-27386 High · 7.5 CWE-862 Mar 5, 2026
WordPress DesignThemes Directory Addon plugin <= 1.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Directory Addon: from n/a through <= 1.8.
CVE-2026-27385 High · 7.1 CWE-79 Mar 5, 2026
WordPress DesignThemes Portfolio plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfolio allows Reflected XSS.This issue affects DesignThemes Portfolio: from n/a through <= 1.3.
CVE-2026-22473 High · 8.8 CWE-502 Mar 5, 2026
WordPress Dental Clinic theme <= 3.7 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through <= 3.7.
CVE-2025-69302 High · 7.1 CWE-79 Feb 20, 2026
WordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignThemes Core Features: from n/a through <= 2.3.
CVE-2025-69095 Medium · 6.5 CWE-862 Jan 22, 2026
WordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerability
Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.
CVE-2025-69002 High · 8.8 CWE-502 Jan 22, 2026
WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.
CVE-2025-68899 High · 8.8 CWE-502 Jan 22, 2026
WordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4.
CVE-2025-67619 High · 8.8 CWE-502 Jan 22, 2026
WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through <= 3.2.
CVE-2025-68982 Medium · 5.3 CWE-862 Dec 30, 2025
WordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes LMS Addon: from n/a through <= 2.6.
CVE-2025-68981 Medium · 5.3 CWE-862 Dec 30, 2025
WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.
CVE-2025-68980 Medium · 5.3 CWE-862 Dec 30, 2025
WordPress WeDesignTech Portfolio plugin <= 1.0.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.
CVE-2025-68978 Medium · 6.5 CWE-79 Dec 30, 2025
WordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows DOM-Based XSS.This issue affects DesignThemes Core: from n/a through <= 1.6.
CVE-2025-68977 Medium · 6.5 CWE-79 Dec 30, 2025
WordPress DesignThemes Portfolio Addon plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through <= 1.5.