Designthemes

44 CVEs across 38 Designthemes products. Browse Designthemes vulnerabilities, severities, and proof-of-concept exploits.

Designthemes products with known CVEs

ProductCVEs
Designthemes Core Features3
Lms3
Reservation Plugin2
Wedesigntech Ultimate Booking Addon2
Crafts & Arts1
Dental Clinic1
Designthemes Booking Manager1
Designthemes Core1
Designthemes Directory Addon1
Designthemes Lms1
Designthemes Lms Addon1
Designthemes Portfolio1
Designthemes Portfolio Addon1
Dt Lms – Elearning, WordPress Lms Plugin1
Finance Consultant1
Fitness Zone WordPress Theme1
Homefix Elementor Portfolio1
Insurance1
Invico - WordPress Consulting Business Theme1
Kids Heaven1
Kids Life | Children School WordPress1
Knowledge Base1
Kriya1
Lms Elementor Pro1
Ofiz - WordPress Business Consulting Theme1
Onelife1
Pet World1
Red Art1
Single Property1
Solar Energy1
Spalab | Beauty Salon WordPress Theme1
Trendy Travel1
Triss1
Veda1
Veda - Multipurpose WordPress Theme1
Visual Art | Gallery WordPress Theme1
Vivagh1
Wedesigntech Portfolio1
Designthemes CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-11355Medium5.32026-09-12The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJA…
CVE-2026-27404High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.
CVE-2026-27402High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.
CVE-2025-69155High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.
CVE-2025-69154High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions.
CVE-2025-69153High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.
CVE-2026-27983Critical9.82026-03-05Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor P…
CVE-2026-27390High8.82026-03-05Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon…
CVE-2026-27389Critical9.82026-03-05Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon…
CVE-2026-27388High7.52026-03-05Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access C…
CVE-2026-27386High7.52026-03-05Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access C…
CVE-2026-27385High7.12026-03-05Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfoli…
CVE-2026-22473High8.82026-03-05Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through…
CVE-2025-69302High7.12026-02-20Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core…
CVE-2025-69095Medium6.52026-01-22Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security L…
CVE-2025-69002High8.82026-01-22Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.
CVE-2025-68899High8.82026-01-22Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4.
CVE-2025-67619High8.82026-01-22Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through…
CVE-2025-68982Medium5.32025-12-30Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Secur…
CVE-2025-68981Medium5.32025-12-30Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control S…
CVE-2025-68980Medium5.32025-12-30Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Secur…
CVE-2025-68978Medium6.52025-12-30Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows D…
CVE-2025-68977Medium6.52025-12-30Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-po…
CVE-2025-64221High7.12025-12-18Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Reservation Plugin dt-reservation-plugin all…
CVE-2025-13542Critical9.82025-12-02The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register…
CVE-2025-60234High8.82025-10-22Deserialization of Untrusted Data vulnerability in designthemes Single Property single-property allows Object Injection.This issue affects Single Property: fro…
CVE-2025-60228High8.82025-10-22Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a throug…
CVE-2025-60215High8.82025-10-22Deserialization of Untrusted Data vulnerability in designthemes Kriya kriya allows Object Injection.This issue affects Kriya: from n/a through <= 3.4.
CVE-2025-60212High8.82025-10-22Deserialization of Untrusted Data vulnerability in designthemes VEDA veda allows Object Injection.This issue affects VEDA: from n/a through <= 4.2.
CVE-2025-53423High7.12025-10-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Triss triss allows Reflected XSS.This issue…
CVE-2025-32283High8.82025-10-22Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <=…
CVE-2025-31634High8.82025-10-22Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3…
CVE-2025-31427High7.12025-07-16Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Invico - WordPress Consulting Business Theme…
CVE-2025-31422High8.82025-07-16Deserialization of Untrusted Data vulnerability in designthemes Visual Art | Gallery WordPress Theme visual-arts allows Object Injection.This issue affects Vis…
CVE-2025-31072High7.12025-07-16Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Ofiz - WordPress Business Consulting Theme o…
CVE-2025-52833Critical9.32025-07-04Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in designthemes LMS lms allows SQL Injection.This issue affe…
CVE-2025-52828High8.82025-07-04Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through <= 3.8.
CVE-2025-52799High7.12025-06-27Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes LMS lms allows Reflected XSS.This issue affe…
CVE-2025-32293High8.82025-05-23Deserialization of Untrusted Data vulnerability in designthemes Finance Consultant finance allows Object Injection.This issue affects Finance Consultant: from…
CVE-2025-32284High8.82025-05-23Deserialization of Untrusted Data vulnerability in designthemes Pet World petsworld allows Object Injection.This issue affects Pet World: from n/a through <= 2…
CVE-2025-31924High8.82025-05-23Deserialization of Untrusted Data vulnerability in designthemes Crafts & Arts crafts-and-arts allows Object Injection.This issue affects Crafts & Arts: from n/…
CVE-2025-0845Medium6.42025-03-25The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to in…
CVE-2024-13471High7.52025-03-05The DesignThemes Core Features plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dt_process_imported_f…
CVE-2024-13787Critical9.82025-03-05The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization…