Dt The7 Vulnerabilities

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all versions up to, and including, 14.3.2. This is due to insufficient input sanitization and output escaping on the 'title' component of the 'link' shortcode parameter. This makes it possible for authenti...

CVSS:

6.4

Affected:

up to 14.3.2

Fixed in:

14.3.3

Disclosed:

May 14, 2026

CVE-2026-6646 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dream-Theme The7 dt-the7 allows DOM-Based XSS.This issue affects The7: from n/a through <= 12.8.0.2.

Affected:

up to 12.8.0.2

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-63073 on NVD →

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 dt-the7 allows PHP Local File Inclusion.This issue affects The7: from n/a through <= 12.8.0.2.

Affected:

up to 12.8.0.2

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-63074 on NVD →

[en] The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7_fancy_title_css’ parameter in all versions up to, and including, 12.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

Affected:

up to 12.9.2

Fixed in:

12.9.2

Disclosed:

Oct 25, 2025

CVE-2025-11897 on NVD →

The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7_fancy_title_css’ parameter in all versions up to, and including, 12.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, w...

CVSS:

6.4

Affected:

up to 12.9.1

Fixed in:

12.9.2

Disclosed:

Oct 24, 2025

CVE-2025-11897 on NVD →

Affected:

up to 12.9.2

Fixed in:

12.9.2

Disclosed:

Oct 24, 2025

CVE-2025-11897 on NVD →

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and excluding, 12.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will e...

CVSS:

6.4

Affected:

up to 12.9.0

Fixed in:

12.9.0

Disclosed:

Oct 5, 2025

CVE-2025-63073 on NVD →

Affected:

up to 12.9.0

Fixed in:

12.9.0

Disclosed:

Oct 5, 2025

CVE-2025-63073 on NVD →

The The7 theme for WordPress is vulnerable to Local File Inclusion in versions up to, and excluding, 12.8.1.1. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This ca...

CVSS:

7.5

Affected:

up to 12.8.1.1

Fixed in:

12.8.1.1

Disclosed:

Oct 4, 2025

CVE-2025-63074 on NVD →

Affected:

up to 12.8.1.1

Fixed in:

12.8.1.1

Disclosed:

Oct 4, 2025

CVE-2025-63074 on NVD →

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via its lightbox rendering code in all versions up to, and including, 12.6.0 due to insufficient input sanitization and output escaping. The theme’s JavaScript reads user-supplied 'title' and 'data-dt-img-description' attributes directly via jQue...

CVSS:

6.4

Affected:

up to 12.6.0

Fixed in:

12.7.0

Disclosed:

Aug 9, 2025

CVE-2025-7726 on NVD →

Affected:

up to 12.7.0

Fixed in:

12.7.0

Disclosed:

Aug 9, 2025

CVE-2025-7726 on NVD →

[en] The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's Icon and Heading widgets in all versions up to, and including, 11.13.0 due to insufficient input sanitization and output escaping on user supplied attr...

Affected:

up to 11.14.0

Fixed in:

11.14.0

Disclosed:

Jun 25, 2024

CVE-2024-5451 on NVD →

The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's Icon and Heading widgets in all versions up to, and including, 11.13.0 due to insufficient input sanitization and output escaping on user supplied attribute...

CVSS:

6.4

Affected:

up to 11.13.0

Fixed in:

11.14.0

Disclosed:

Jun 24, 2024

CVE-2024-5451 on NVD →

Affected:

up to 11.14.0

Fixed in:

11.14.0

Disclosed:

Jun 24, 2024

CVE-2024-5451 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Dream-Theme The7 allows Stored XSS.This issue affects The7: from n/a through 11.7.3.

Affected:

up to 11.6.0

Fix:

No patched version reported

Disclosed:

Nov 13, 2023

CVE-2023-32123 on NVD →

The The7 theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 11.7.3. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site...

CVSS:

4.3

Affected:

up to 11.7.3

Fixed in:

11.7.3.1

Disclosed:

Jun 28, 2023

CVE-2023-32123 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dream-Theme The7 plugin <= 11.6.0 versions.

Affected:

up to 11.6.1

Fixed in:

11.6.1

Disclosed:

Jun 23, 2023

CVE-2023-29100 on NVD →

The The7 theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the legacy "DT Flickr" widget in versions up to, and including, 11.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i...

CVSS:

6.1

Affected:

up to 11.6.0

Fixed in:

11.6.1

Disclosed:

Apr 6, 2023

CVE-2023-29100 on NVD →

Affected:

up to 11.6.1

Fixed in:

11.6.1

Disclosed:

Apr 6, 2023

CVE-2023-29100 on NVD →

The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a vict...

CVSS:

6.1

Affected:

up to 2.1.0

Fixed in:

2.1.1

Disclosed:

Apr 25, 2015

The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a vict...

Affected:

up to 2.1.1

Fixed in:

2.1.1

Disclosed:

Apr 25, 2015

Affected:

up to 2.1.1

Fixed in:

2.1.1

Disclosed:

Apr 25, 2015

Affected:

up to 12.7.0

Fixed in:

12.7.0

CVE-2025-7726 on NVD →

The the7 WordPress theme was affected by a Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 2.1.1

Fixed in:

2.1.1