U Design Vulnerabilities

The uDesign - Responsive WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...

CVSS:

6.1

Affected:

up to 4.14.0

Fix:

No patched version reported

Disclosed:

Feb 26, 2026

CVE-2026-28130 on NVD →

The UDesign theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a...

CVSS:

6.1

Affected:

up to 4.7.3

Fix:

No patched version reported

Disclosed:

Apr 23, 2024

CVE-2024-4077 on NVD →

Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.

CVSS:

6.1

Affected:

2.3.0 – 2.7.9

Fixed in:

2.7.10

Disclosed:

Oct 5, 2015

CVE-2015-7357 on NVD →