The7 vulnerabilities

The The7 theme versions up to 14.2.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without logging in can gain unauthorized access to functions or data.

DOM-Based XSS vulnerability in The7 theme by Dream-Theme. Improper input neutralization during web page generation allows client-side script injection.

The The7 — Website and eCommerce Builder for WordPress theme is vulnerable to Stored Cross-Site Scripting via the 'the7_fancy_title_css' parameter in all versions up to, and including, 12.9.1. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts.