Skip to content
OpenAdvisories

Vendor

designthemes

46 known vulnerabilities.

Products

LMS 4 DesignThemes Core Features 3 Reservation Plugin 2 WeDesignTech Ultimate Booking Addon 2 Trendy Travel 1 Pet World 1 DesignThemes Booking Manager 1 Invico - WordPress Consulting Business Theme 1 DesignThemes Portfolio Addon 1 Vivagh 1 DesignThemes LMS 1 VEDA - MultiPurpose WordPress Theme 1 Kids Life | Children School WordPress 1 HomeFix Elementor Portfolio 1 Kriya 1 WeDesignTech Portfolio 1 Whistle - Sports Club 1 VEDA 1 DT LMS – elearning, WordPress LMS Plugin 1 DesignThemes LMS Addon 1 Visual Art | Gallery WordPress Theme 1 Finance Consultant 1 DesignThemes Core 1 Red Art 1 Solar Energy 1 SpaLab | Beauty Salon WordPress Theme 1 OneLife 1 Single Property 1 Dental Clinic 1 DesignThemes Directory Addon 1 Crafts & Arts 1 DesignThemes Portfolio 1 Knowledge Base 1 Triss 1 Ofiz - WordPress Business Consulting Theme 1 Fitness Zone WordPress Theme 1 Kids Heaven 1 LMS Elementor Pro 1 Insurance 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-11355

    DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions

    The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_sett…

    designthemes DT LMS – elearning, WordPress LMS Plugin Web / CMS
  • Medium 6.5
    CVE-2025-69095

    WordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerability

    Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.

    designthemes Reservation Plugin
  • Medium 5.3
    CVE-2025-68982

    WordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes LMS Addon: from n/a through <= 2.6.

    designthemes DesignThemes LMS Addon
  • Medium 5.3
    CVE-2025-68981

    WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.

    designthemes HomeFix Elementor Portfolio
  • Medium 6.5
    CVE-2025-68978

    WordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows DOM-Based XSS.This issue affects DesignThemes Core: from n/a through <= 1.6.

    designthemes DesignThemes Core
  • Medium 5.3
    CVE-2025-68980

    WordPress WeDesignTech Portfolio plugin <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.

    designthemes WeDesignTech Portfolio
  • Medium 6.5
    CVE-2025-68977

    WordPress DesignThemes Portfolio Addon plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through…

    designthemes DesignThemes Portfolio Addon
  • Medium 6.4
    CVE-2025-0845

    DesignThemes Core Features <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl…

    designthemes DesignThemes Core Features Web / CMS