Designthemes vulnerabilities
Published CVEs affecting Designthemes products: 35 record(s), with severity, exploitation and fixes.
DesignThemes LMS 3WeDesignTech Ultimate Booking Addon 2Reservation Plugin 2Single Property 1DesignThemes Portfolio Addon 1WeDesignTech Portfolio 1DesignThemes Core 1DesignThemes LMS Addon 1Triss 1Knowledge Base 1VEDA 1Kriya 1Trendy Travel 1SpaLab | Beauty Salon WordPress Theme 1Kids Zone - Children WordPress Theme 1Kids Life | Children School WordPress 1DT LMS – elearning, WordPress LMS Plugin 1HomeFix Elementor Portfolio 1Fitness Zone WordPress Theme 1DesignThemes Core Features 1OneLife 1Vivagh 1Kids Heaven 1Solar Energy 1Insurance 1Whistle - Sports Club 1LMS Elementor Pro 1DesignThemes Booking Manager 1DesignThemes Directory Addon 1DesignThemes Portfolio 1Dental Clinic 1
CVE-2025-68977
Medium · 6.5
CWE-79 Dec 30, 2025
WordPress DesignThemes Portfolio Addon plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through <= 1.5.
CVE-2025-64221
High · 7.1
CWE-79 Dec 18, 2025
WordPress Reservation Plugin plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Reflected XSS.This issue affects Reservation Plugin: from n/a through <= 1.6.
CVE-2025-13542
Critical · 9.8
CWE-269 Dec 2, 2025
DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation
The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
CVE-2025-60234
High · 8.8
CWE-502 Oct 22, 2025
WordPress Single Property theme <= 2.8 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in designthemes Single Property single-property allows Object Injection.This issue affects Single Property: from n/a through <= 2.8.
CVE-2025-60228
High · 8.8
CWE-502 Oct 22, 2025
WordPress Knowledge Base theme <= 2.9 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a through <= 2.9.
CVE-2025-60215
High · 8.8
CWE-502 Oct 22, 2025
WordPress Kriya theme <= 3.4 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in designthemes Kriya kriya allows Object Injection.This issue affects Kriya: from n/a through <= 3.4.
CVE-2025-60212
High · 8.8
CWE-502 Oct 22, 2025
WordPress VEDA Theme <= 4.2 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in designthemes VEDA veda allows Object Injection.This issue affects VEDA: from n/a through <= 4.2.
CVE-2025-53423
High · 7.1
CWE-79 Oct 22, 2025
WordPress Triss theme <= 2.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Triss triss allows Reflected XSS.This issue affects Triss: from n/a through <= 2.6.
CVE-2025-32283
High · 8.8
CWE-502 Oct 22, 2025
WordPress Solar Energy theme <= 3.5 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5.
CVE-2025-31634
High · 8.8
CWE-502 Oct 22, 2025
WordPress Insurance theme <= 3.5 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5.