Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26

Export CSV
CVE-2025-13542

DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation

The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Designthemes Lms Wordpress
CVE-2025-67619

WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through <= 3.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Kids Heaven Wordpress
CVE-2025-69302

WordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignThemes Core Features: from n/a through <= 2.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Designthemes Core Features Wordpress
CVE-2025-69002

WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Onelife Wordpress
CVE-2025-60228

WordPress Knowledge Base theme <= 2.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a through <= 2.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Knowledge Base Wordpress
CVE-2025-68899

WordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Vivagh Wordpress