Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26

Export CSV
CVE-2026-11355

DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions

The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings) in versions up to, and including, 1.1. These handlers are registered on the wp_ajax_nopriv_* hook and contain no capability check, no nonce verification, and pass user-supplied data directly to update_option(). This makes it possible for unauthenticated attackers to overwrite arbitrary plugin option values stored in the wp_options table, including Point-of-Contact email configuration and skin/branding settings, which can be used to alter the appearance and behavior of the LMS for all site visitors.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Dt Lms – Elearning, Wordpress Lms Plugin Wordpress
CVE-2026-27404

WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Lms Wordpress
CVE-2025-68982

WordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes LMS Addon: from n/a through <= 2.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Designthemes Lms Wordpress
CVE-2025-68981

WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Designthemes Elementor Wordpress
Products
Homefix Elementor Portfolio Elementor Wordpress
CVE-2025-68980

WordPress WeDesignTech Portfolio plugin <= 1.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Wedesigntech-portfolio Wordpress
CVE-2025-64221

WordPress Reservation Plugin plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Reflected XSS.This issue affects Reservation Plugin: from n/a through <= 1.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Reservation Plugin Wordpress
CVE-2025-68977

WordPress DesignThemes Portfolio Addon plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through <= 1.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Portfolio Addon Wordpress
CVE-2025-68978

WordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows DOM-Based XSS.This issue affects DesignThemes Core: from n/a through <= 1.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Core Wordpress
CVE-2025-69095

WordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerability

Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Reservation Plugin Wordpress
CVE-2026-27386

WordPress DesignThemes Directory Addon plugin <= 1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Directory Addon: from n/a through <= 1.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Designthemes Directory Addon Wordpress
CVE-2026-27983

WordPress LMS Elementor Pro plugin <= 1.0.4 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor Pro: from n/a through <= 1.0.4.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Lms Elementor Pro Wordpress
CVE-2026-22473

WordPress Dental Clinic theme <= 3.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through <= 3.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Dental Clinic Wordpress
CVE-2026-27385

WordPress DesignThemes Portfolio plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfolio allows Reflected XSS.This issue affects DesignThemes Portfolio: from n/a through <= 1.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Designthemes Portfolio Wordpress
CVE-2026-27388

WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Booking Manager: from n/a through <= 2.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Designthemes Booking Manager Wordpress
CVE-2026-27389

WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Wedesigntech Ultimate Booking Addon Wordpress
CVE-2026-27390

WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Wedesigntech Ultimate Booking Addon Wordpress