Dream-theme

The7

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2025-63073

  • EPSS 0.05%
  • Veröffentlicht 09.12.2025 14:52:36
  • Zuletzt bearbeitet 20.01.2026 15:18:40

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dream-Theme The7 dt-the7 allows DOM-Based XSS.This issue affects The7: from n/a through <= 12.8.0.2.

7.5

CVE-2025-63074

  • EPSS 0.17%
  • Veröffentlicht 09.12.2025 14:52:36
  • Zuletzt bearbeitet 20.01.2026 15:18:40

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 dt-the7 allows PHP Local File Inclusion.This issue affects The7: from n/a through <= 12.8.0.2.

6.4

CVE-2025-11897

  • EPSS 0.05%
  • Veröffentlicht 25.10.2025 12:26:28
  • Zuletzt bearbeitet 27.10.2025 13:20:15

The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7_fancy_title_css’ parameter in all versions up to, and including, 12.9.1 due to insufficient input sanitization and ...

6.4

CVE-2025-7726

  • EPSS 0.04%
  • Veröffentlicht 09.08.2025 13:45:05
  • Zuletzt bearbeitet 11.08.2025 18:32:48

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via its lightbox rendering code in all versions up to, and including, 12.6.0 due to insufficient input sanitization and output escaping. The theme’s JavaScript reads user-suppl...

6.4

CVE-2024-5451

  • EPSS 0.25%
  • Veröffentlicht 25.06.2024 14:15:12
  • Zuletzt bearbeitet 21.11.2024 09:47:42

The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's Icon and Heading widgets in all versions up to, and including, 11.13.0 due to insuffic...

6.1

CVE-2023-32123

  • EPSS 0.06%
  • Veröffentlicht 13.11.2023 18:15:07
  • Zuletzt bearbeitet 21.11.2024 08:02:45

Cross-Site Request Forgery (CSRF) vulnerability in Dream-Theme The7 allows Stored XSS.This issue affects The7: from n/a through 11.7.3.

6.1

CVE-2023-29100

  • EPSS 0.08%
  • Veröffentlicht 23.06.2023 13:15:10
  • Zuletzt bearbeitet 21.11.2024 07:56:32

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dream-Theme The7 plugin <= 11.6.0 versions.