Designthemes

38 CVEs across 37 Designthemes products. Browse Designthemes vulnerabilities, severities, and proof-of-concept exploits.

Designthemes products with known CVEs

ProductCVEs
Designthemes Core Features3
Lms3
Reservation Plugin2
Wedesigntech Ultimate Booking Addon2
Crafts & Arts1
Dental Clinic1
Designthemes Booking Manager1
Designthemes Core1
Designthemes Directory Addon1
Designthemes Lms1
Designthemes Lms Addon1
Designthemes Portfolio1
Designthemes Portfolio Addon1
Finance Consultant1
Fitness Zone Wordpress Theme1
Homefix Elementor Portfolio1
Insurance1
Invico - Wordpress Consulting Business Theme1
Kids Heaven1
Kids Life | Children School Wordpress1
Knowledge Base1
Kriya1
Lms Elementor Pro1
Ofiz - Wordpress Business Consulting Theme1
Onelife1
Pet World1
Red Art1
Single Property1
Solar Energy1
Spalab | Beauty Salon Wordpress Theme1
Trendy Travel1
Triss1
Veda1
Veda - Multipurpose Wordpress Theme1
Visual Art | Gallery Wordpress Theme1
Vivagh1
Wedesigntech Portfolio1
Designthemes CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-27404High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.
CVE-2026-27402High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.
CVE-2025-69155High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.
CVE-2025-69154High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions.
CVE-2025-69153High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.
CVE-2026-27983Critical9.82026-03-05Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor P…
CVE-2026-27390High8.82026-03-05Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon…
CVE-2026-27389Critical9.82026-03-05Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon…
CVE-2026-27388High7.52026-03-05Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access C…
CVE-2026-27386High7.52026-03-05Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access C…
CVE-2026-27385High7.12026-03-05Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfoli…
CVE-2026-22473High8.82026-03-05Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through…
CVE-2025-69302High7.12026-02-20Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core…
CVE-2025-69095Medium6.52026-01-22Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security L…
CVE-2025-69002High8.82026-01-22Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.
CVE-2025-68899High8.82026-01-22Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4.
CVE-2025-67619High8.82026-01-22Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through…
CVE-2025-68982Medium5.32025-12-30Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Secur…
CVE-2025-68981Medium5.32025-12-30Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control S…
CVE-2025-68980Medium5.32025-12-30Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Secur…
CVE-2025-68978Medium6.52025-12-30Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows D…
CVE-2025-68977Medium6.52025-12-30Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-po…
CVE-2025-64221High7.12025-12-18Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Reservation Plugin dt-reservation-plugin all…
CVE-2025-13542Critical9.82025-12-02The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register…
CVE-2025-60234High8.82025-10-22Deserialization of Untrusted Data vulnerability in designthemes Single Property single-property allows Object Injection.This issue affects Single Property: fro…
CVE-2025-60228High8.82025-10-22Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a throug…
CVE-2025-60215High8.82025-10-22Deserialization of Untrusted Data vulnerability in designthemes Kriya kriya allows Object Injection.This issue affects Kriya: from n/a through <= 3.4.
CVE-2025-60212High8.82025-10-22Deserialization of Untrusted Data vulnerability in designthemes VEDA veda allows Object Injection.This issue affects VEDA: from n/a through <= 4.2.
CVE-2025-53423High7.12025-10-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Triss triss allows Reflected XSS.This issue…
CVE-2025-32283High8.82025-10-22Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <=…
CVE-2025-31634High8.82025-10-22Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3…
CVE-2025-31427High7.12025-07-16Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Invico - WordPress Consulting Business Theme…
CVE-2025-31422High8.82025-07-16Deserialization of Untrusted Data vulnerability in designthemes Visual Art | Gallery WordPress Theme visual-arts allows Object Injection.This issue affects Vis…
CVE-2025-31072High7.12025-07-16Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Ofiz - WordPress Business Consulting Theme o…
CVE-2025-52833Critical9.32025-07-04Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in designthemes LMS lms allows SQL Injection.This issue affe…
CVE-2025-52828High8.82025-07-04Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through <= 3.8.
CVE-2025-52799High7.12025-06-27Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes LMS lms allows Reflected XSS.This issue affe…
CVE-2025-32293High8.82025-05-23Deserialization of Untrusted Data vulnerability in designthemes Finance Consultant finance allows Object Injection.This issue affects Finance Consultant: from…
CVE-2025-32284High8.82025-05-23Deserialization of Untrusted Data vulnerability in designthemes Pet World petsworld allows Object Injection.This issue affects Pet World: from n/a through <= 2…
CVE-2025-31924High8.82025-05-23Deserialization of Untrusted Data vulnerability in designthemes Crafts & Arts crafts-and-arts allows Object Injection.This issue affects Crafts & Arts: from n/…
CVE-2025-0845Medium6.42025-03-25The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to in…
CVE-2024-13471High7.52025-03-05The DesignThemes Core Features plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dt_process_imported_f…
CVE-2024-13787Critical9.82025-03-05The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization…