Dream-Theme

Products

Product	CVEs	Exploited	Latest
The7	4	–	Dec 9, 2025
The7 — Website and eCommerce Builder for WordPress	4	–	May 15, 2026
The7 Elements	1	–	Dec 9, 2025

CVE-2026-6646 Medium 6.4 The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter 0.3%
CVE-2025-63076 High 7.5 WordPress The7 Elements plugin <= 2.7.11 - Local File Inclusion vulnerability 0.5%
CVE-2025-63074 High 7.5 WordPress The7 theme < 12.8.1.1 - Local File Inclusion vulnerability 0.5%
CVE-2025-63073 Medium 6.5 WordPress The7 theme < 12.9.0 - Cross Site Scripting (XSS) vulnerability 0.2%
CVE-2025-11897 Medium 6.4 The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css' 0.2%
CVE-2025-7726 Medium 6.4 The7 <= 12.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title and data-dt-img-description Attributes 0.3%
CVE-2024-5451 Medium 6.4 The7 — Website and eCommerce Builder for WordPress <= 11.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute 0.3%
CVE-2023-32123 Medium 6.1 WordPress The7 Theme <= 11.7.3 is vulnerable to Cross Site Request Forgery (CSRF) 0.2%
CVE-2023-29100 High 7.1 WordPress The7 Theme <= 11.6.0 is vulnerable to Cross Site Scripting (XSS) 0.4%