93 matches found
CVE-2025-11897
The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7fancytitlecss’ parameter in all versions up to, and including, 12.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2025-11897 The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'
The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7fancytitlecss’ parameter in all versions up to, and including, 12.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2025-11897
CVE-2025-11897 (The7 theme) The7 — Website and eCommerce Builder for WordPress theme is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the the7_fancy_title_css parameter for all versions up to and including 12.9.1. Exploitation requires authenticated access at Contributor level ...
CVE-2025-11897 The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'
The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7fancytitlecss’ parameter in all versions up to, and including, 12.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress The7 theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css' vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'the7fancytitlecss' vulnerability discovered by Muhammad Yudha - DJ in WordPress Theme The7 versions = 12.9.1...
WordPress The7 Theme <= 12.9.1 is vulnerable to Cross Site Scripting (XSS)
Software The7 Type Theme Vulnerable versions = 12.9.1 Fixed in 12.9.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-11897 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 600f7d8465b6 Credits Muhammad Yudha - DJ Required...
CVE-2025-11897: Improper Neutralization of Input During Web Page Generation
The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7fancytitlecss’ parameter in all versions up to, and including, 12.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2025-43730
Name of the Vulnerable Software and Affected Versions The7 — Website and eCommerce Builder for WordPress theme versions prior to 12.9.2 Description The software is susceptible to a Stored Cross-Site Scripting issue because of inadequate input sanitization and output escaping. This allows...
WordPress The7 Elements plugin <= 2.7.11 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin The7 Elements versions = 2.7.11...
WordPress The7 theme < 12.9.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme The7 versions 12.9.0...
WordPress The7 theme < 12.8.1.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme The7 versions 12.8.1.1...
EUVD-2023-32703
Malicious code in bioql PyPI...
EUVD-2025-24051
Malicious code in bioql PyPI...
EUVD-2023-36391
Malicious code in bioql PyPI...
WordPress The7 plugin cross-site scripting vulnerability
WordPress The7 plugin is a highly customizable WordPress theme. WordPress The7 plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to execute arbitrary web...
WordPress The7 theme <= 12.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title and data-dt-img-description Attributes vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via title and data-dt-img-description Attributes vulnerability discovered by Webbernaut in WordPress Theme The7 versions = 12.6.0...
CVE-2025-7726
The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via its lightbox rendering code in all versions up to, and including, 12.6.0 due to insufficient input sanitization and output escaping. The theme’s JavaScript reads user-supplied 'title' and 'data-dt-img-description'...
WordPress The7 Theme <= 12.6.0 is vulnerable to Cross Site Scripting (XSS)
Software The7 Type Theme Vulnerable versions = 12.6.0 Fixed in 12.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-7726 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 79f4fdafca8f Credits Webbernaut Required privilege...
CVE-2025-7726
The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via its lightbox rendering code in all versions up to, and including, 12.6.0 due to insufficient input sanitization and output escaping. The theme’s JavaScript reads user-supplied 'title' and 'data-dt-img-description'...