Skip to content
OpenAdvisories

Vendor

PenciDesign

34 known vulnerabilities.

Products

Soledad 13 Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme 3 Penci Podcast 2 Penci Recipe 2 Penci Shortcodes & Performance 2 Penci Filter Everything 2 Penci Soledad Data Migrator 2 PenNews 2 Penci Review 1 Penci Bookmark & Follow 1 Soledad (WordPress theme) 1 Penci Pay Writer 1 Penci Portfolio 1 Penci AI SmartContent Creator 1
All Critical High Medium Low Exploited only Public exploit

20 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-93902

    Soledad <= 8.7.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Social Profile Fields

    The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, …

    PenciDesign Soledad Web / CMS
  • Medium 6.5
    CVE-2026-27069

    WordPress Soledad theme <= 8.7.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad soledad allows DOM-Based XSS.This issue affects Soledad: from n/a through <= 8.7.2.

    PenciDesign Soledad
  • Medium 6.5
    CVE-2026-27057

    WordPress Penci Filter Everything plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Filter Everything penci-filter-everything allows Stored XSS.This issue affects Penci Filter Everything: from n/a through <= 1.7.

    PenciDesign Penci Filter Everything
  • Medium 6.5
    CVE-2026-27059

    WordPress Penci Recipe plugin <= 4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affects Penci Recipe: from n/a through <= 4.1.

    PenciDesign Penci Recipe
  • Medium 6.5
    CVE-2026-27058

    WordPress Penci Podcast plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Podcast penci-podcast allows DOM-Based XSS.This issue affects Penci Podcast: from n/a through <= 1.7.

    PenciDesign Penci Podcast
  • Medium 4.3
    CVE-2026-27055

    WordPress Penci AI SmartContent Creator plugin <= 2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PenciDesign Penci AI SmartContent Creator penci-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Penci AI SmartContent Creator: from n/a through <= 2.0.

    PenciDesign Penci AI SmartContent Creator
  • Medium 6.5
    CVE-2026-24601

    WordPress Penci Pay Writer plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Pay Writer penci-pay-writer allows Stored XSS.This issue affects Penci Pay Writer: from n/a through <= 1.5.

    PenciDesign Penci Pay Writer
  • Medium 6.5
    CVE-2026-24600

    WordPress Penci Review plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Review penci-review allows Stored XSS.This issue affects Penci Review: from n/a through <= 3.5.

    PenciDesign Penci Review
  • Medium 6.5
    CVE-2026-24354

    WordPress Penci Shortcodes & Performance plugin <= 6.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Shortcodes & Performance penci-shortcodes allows DOM-Based XSS.This issue affects Penci Shortcodes & Performance: from n/a through <= 6.1.

    PenciDesign Penci Shortcodes & Performance
  • Medium 5.3
    CVE-2025-67572

    WordPress PenNews theme < 6.7.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PenciDesign PenNews pennews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PenNews: from n/a through < 6.7.4.

    PenciDesign PenNews
  • Medium 6.5
    CVE-2025-59583

    WordPress Penci Filter Everything Plugin < 1.7 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Filter Everything penci-filter-everything allows DOM-Based XSS.This issue affects Penci Filter Everything: from n/a through < 1.7.

    PenciDesign Penci Filter Everything
  • Medium 6.5
    CVE-2025-59584

    WordPress Penci Podcast Plugin <= 1.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Podcast penci-podcast allows DOM-Based XSS.This issue affects Penci Podcast: from n/a through <= 1.6.

    PenciDesign Penci Podcast
  • Medium 6.5
    CVE-2025-59585

    WordPress Penci Recipe Plugin <= 4.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affects Penci Recipe: from n/a through <= 4.0.

    PenciDesign Penci Recipe
  • Medium 6.5
    CVE-2025-59586

    WordPress Penci Portfolio Plugin <= 3.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Portfolio penci-portfolio allows DOM-Based XSS.This issue affects Penci Portfolio: from n/a through <= 3.5.

    PenciDesign Penci Portfolio
  • Medium 6.5
    CVE-2025-59587

    WordPress Penci Shortcodes & Performance Plugin < 6.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Shortcodes & Performance penci-shortcodes allows DOM-Based XSS.This issue affects Penci Shortcodes & Performance: from n/a through < 6.1.

    PenciDesign Penci Shortcodes & Performance
  • Medium 6.5
    CVE-2025-59589

    WordPress Soledad Theme <= 8.6.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad soledad allows DOM-Based XSS.This issue affects Soledad: from n/a through <= 8.6.8.

    PenciDesign Soledad
  • Medium 6.4
    CVE-2025-8143

    Soledad <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h'

    The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pcsml_smartlists_h’ parameter in all versions up to, and including, 8.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticate…

    PenciDesign Soledad Web / CMS
  • Medium 5.4
    CVE-2024-31369

    WordPress Soledad theme <= 8.4.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2.

    PenciDesign Soledad
  • Medium 6.5
    CVE-2024-31368

    WordPress Soledad theme <= 8.4.2 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2.

    PenciDesign Soledad
  • Medium 5.4
    CVE-2022-41788

    WordPress Soledad premium theme <= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerability

    Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress.

    PenciDesign Soledad (WordPress theme) Web / CMS