# cve.now: Designthemes The newest entries naming Designthemes as an affected vendor (up to 200), of 46 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-78532](https://cve.now/CVE-2026-78532.md): WordPress LMS theme \<= 8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2026-94061](https://cve.now/CVE-2026-94061.md): WordPress Whistle - Sports Club theme \<= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2026-11355](https://cve.now/CVE-2026-11355.md): DT LMS \<= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions (CVSS 5.3) - [CVE-2026-27404](https://cve.now/CVE-2026-27404.md): WordPress LMS theme \<= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2026-27402](https://cve.now/CVE-2026-27402.md): WordPress Kids Life | Children School WordPress theme \<= 5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2025-69155](https://cve.now/CVE-2025-69155.md): WordPress Fitness Zone WordPress Theme theme \<= 5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2025-69154](https://cve.now/CVE-2025-69154.md): WordPress SpaLab | Beauty Salon WordPress Theme theme \<= 6.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2025-69153](https://cve.now/CVE-2025-69153.md): WordPress Trendy Travel theme \<= 6.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2026-27983](https://cve.now/CVE-2026-27983.md): WordPress LMS Elementor Pro plugin \<= 1.0.4 - Privilege Escalation vulnerability (CVSS 9.8) - [CVE-2026-27390](https://cve.now/CVE-2026-27390.md): WordPress WeDesignTech Ultimate Booking Addon plugin \<= 1.0.1 - Account Takeover vulnerability (CVSS 8.8) - [CVE-2026-27389](https://cve.now/CVE-2026-27389.md): WordPress WeDesignTech Ultimate Booking Addon plugin \<= 1.0.1 - Account Takeover vulnerability (CVSS 9.8) - [CVE-2026-27388](https://cve.now/CVE-2026-27388.md): WordPress DesignThemes Booking Manager plugin \<= 2.0 - Broken Access Control vulnerability (CVSS 7.5) - [CVE-2026-27386](https://cve.now/CVE-2026-27386.md): WordPress DesignThemes Directory Addon plugin \<= 1.8 - Broken Access Control vulnerability (CVSS 7.5) - [CVE-2026-27385](https://cve.now/CVE-2026-27385.md): WordPress DesignThemes Portfolio plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2026-22473](https://cve.now/CVE-2026-22473.md): WordPress Dental Clinic theme \<= 3.7 - PHP Object Injection vulnerability (CVSS 8.8) - [CVE-2025-69302](https://cve.now/CVE-2025-69302.md): WordPress DesignThemes Core Features plugin \<= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2025-69095](https://cve.now/CVE-2025-69095.md): WordPress Reservation Plugin plugin \<= 1.7 - Settings Change vulnerability (CVSS 6.5) - [CVE-2025-69002](https://cve.now/CVE-2025-69002.md): WordPress OneLife theme \<= 3.9 - PHP Object Injection vulnerability (CVSS 8.8) - [CVE-2025-68899](https://cve.now/CVE-2025-68899.md): WordPress Vivagh theme \<= 2.4 - PHP Object Injection vulnerability (CVSS 8.8) - [CVE-2025-67619](https://cve.now/CVE-2025-67619.md): WordPress Kids Heaven theme \<= 3.2 - PHP Object Injection vulnerability (CVSS 8.8) - [CVE-2025-68982](https://cve.now/CVE-2025-68982.md): WordPress DesignThemes LMS Addon plugin \<= 2.6 - Broken Access Control vulnerability (CVSS 5.3) - [CVE-2025-68981](https://cve.now/CVE-2025-68981.md): WordPress HomeFix Elementor Portfolio plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 5.3) - [CVE-2025-68980](https://cve.now/CVE-2025-68980.md): WordPress WeDesignTech Portfolio plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 5.3) - [CVE-2025-68978](https://cve.now/CVE-2025-68978.md): WordPress DesignThemes Core plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5) - [CVE-2025-68977](https://cve.now/CVE-2025-68977.md): WordPress DesignThemes Portfolio Addon plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5) - [CVE-2025-64221](https://cve.now/CVE-2025-64221.md): WordPress Reservation Plugin plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2025-13542](https://cve.now/CVE-2025-13542.md): DesignThemes LMS \<= 1.0.4 - Unauthenticated Privilege Escalation (CVSS 9.8) - [CVE-2025-60234](https://cve.now/CVE-2025-60234.md): WordPress Single Property theme \<= 2.8 - PHP Object Injection vulnerability (CVSS 8.8) - [CVE-2025-60228](https://cve.now/CVE-2025-60228.md): WordPress Knowledge Base theme \<= 2.9 - PHP Object Injection vulnerability (CVSS 8.8) - [CVE-2025-60215](https://cve.now/CVE-2025-60215.md): WordPress Kriya theme \<= 3.4 - PHP Object Injection Vulnerability (CVSS 8.8) - [CVE-2025-60212](https://cve.now/CVE-2025-60212.md): WordPress VEDA Theme \<= 4.2 - PHP Object Injection Vulnerability (CVSS 8.8) - [CVE-2025-53423](https://cve.now/CVE-2025-53423.md): WordPress Triss theme \<= 2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2025-32283](https://cve.now/CVE-2025-32283.md): WordPress Solar Energy theme \<= 3.5 - PHP Object Injection Vulnerability (CVSS 8.8) - [CVE-2025-31634](https://cve.now/CVE-2025-31634.md): WordPress Insurance theme \<= 3.5 - PHP Object Injection Vulnerability (CVSS 8.8) - [CVE-2025-31072](https://cve.now/CVE-2025-31072.md): WordPress Ofiz - Business Consulting Theme plugin \<= 2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1) - [CVE-2025-31422](https://cve.now/CVE-2025-31422.md): WordPress Visual Art | Gallery WordPress Theme \<= 2.4 - PHP Object Injection Vulnerability (CVSS 8.8) - [CVE-2025-31427](https://cve.now/CVE-2025-31427.md): WordPress Invico - WordPress Consulting Business Theme \<= 1.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1) - [CVE-2025-52828](https://cve.now/CVE-2025-52828.md): WordPress Red Art theme \<= 3.8 - PHP Object Injection Vulnerability (CVSS 8.8) - [CVE-2025-52833](https://cve.now/CVE-2025-52833.md): WordPress LMS theme \<= 9.2 - SQL Injection Vulnerability (CVSS 9.3) - [CVE-2025-52799](https://cve.now/CVE-2025-52799.md): WordPress LMS theme \<= 9.2 - Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 7.1) - [CVE-2025-31924](https://cve.now/CVE-2025-31924.md): WordPress Crafts & Arts theme \<= 2.5 - PHP Object Injection Vulnerability (CVSS 8.8) - [CVE-2025-32284](https://cve.now/CVE-2025-32284.md): WordPress Pet World theme \<= 2.8 - PHP Object Injection Vulnerability (CVSS 8.8) - [CVE-2025-32293](https://cve.now/CVE-2025-32293.md): WordPress Finance Consultant theme \<= 2.8 - PHP Object Injection Vulnerability (CVSS 8.8) - [CVE-2025-0845](https://cve.now/CVE-2025-0845.md): DesignThemes Core Features \<= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4) - [CVE-2024-13471](https://cve.now/CVE-2024-13471.md): DesignThemes Core Features \<= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt\_process\_imported\_file (CVSS 7.5) - [CVE-2024-13787](https://cve.now/CVE-2024-13787.md): VEDA - MultiPurpose WordPress Theme \<= 4.2 - Authenticated (Subscriber+) PHP Object Injection (CVSS 9.8) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/designthemes Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.