Dream-theme

The7

8 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.4

CVE-2026-6646

  • EPSS 0.28%
  • Veröffentlicht 15.05.2026 06:45:57
  • Zuletzt bearbeitet 15.05.2026 14:09:15

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all versions up to, and including, 14.3.2. This is due to insufficient input sanitization and output escaping on the 'title' component ...

6.5

CVE-2025-63073

  • EPSS 0.16%
  • Veröffentlicht 09.12.2025 14:52:36
  • Zuletzt bearbeitet 15.04.2026 00:35:42

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dream-Theme The7 dt-the7 allows DOM-Based XSS.This issue affects The7: from n/a through < 12.9.0.

7.5

CVE-2025-63074

  • EPSS 0.38%
  • Veröffentlicht 09.12.2025 14:52:36
  • Zuletzt bearbeitet 15.04.2026 00:35:42

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 dt-the7 allows PHP Local File Inclusion.This issue affects The7: from n/a through < 12.8.1.1.

6.4

CVE-2025-11897

  • EPSS 0.18%
  • Veröffentlicht 25.10.2025 12:26:28
  • Zuletzt bearbeitet 15.04.2026 00:35:42

The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7_fancy_title_css’ parameter in all versions up to, and including, 12.9.1 due to insufficient input sanitization and ...

6.4

CVE-2025-7726

  • EPSS 0.22%
  • Veröffentlicht 09.08.2025 13:45:05
  • Zuletzt bearbeitet 15.04.2026 00:35:42

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via its lightbox rendering code in all versions up to, and including, 12.6.0 due to insufficient input sanitization and output escaping. The theme’s JavaScript reads user-suppl...

6.4

CVE-2024-5451

  • EPSS 0.33%
  • Veröffentlicht 25.06.2024 14:15:12
  • Zuletzt bearbeitet 15.04.2026 00:35:42

The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's Icon and Heading widgets in all versions up to, and including, 11.13.0 due to insuffic...

6.1

CVE-2023-32123

  • EPSS 0.2%
  • Veröffentlicht 13.11.2023 18:15:07
  • Zuletzt bearbeitet 28.04.2026 19:20:24

Cross-Site Request Forgery (CSRF) vulnerability in Dream-Theme The7 allows Stored XSS.This issue affects The7: from n/a through 11.7.3.

6.1

CVE-2023-29100

  • EPSS 0.38%
  • Veröffentlicht 23.06.2023 13:15:10
  • Zuletzt bearbeitet 21.11.2024 07:56:32

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dream-Theme The7 plugin <= 11.6.0 versions.