shouldiuse.io

Categories

VERDICT

ThemeForest Review

Depends

Should I use ThemeForest?

Discover 1000s of premium WordPress themes & website templates, including multipurpose and responsive Bootstrap templates, email templates & HTML templates. - themeforest.net

· 1 month ago

Buy only if you (or a developer you trust) can vet the code and maintain the theme yourself; the catalog is huge and individually cheap. Non-technical buyers face abandoned themes, published CVEs, and contested refunds — use the free WordPress.org theme directory instead.

Confidence

Medium. Based on ~30 public sources: Reddit and Trustpilot reviews, security advisories, and marketplace pages. Many snippets truncated; user quotes unavailable verbatim.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Per-theme regular license

~$55–$69 in reviewed examples

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierNo

Best for

  • One-off site buyers on a budget
  • Developers who vet and customize code
  • Agencies building throwaway mockups

Not for

  • Non-technical owners wanting zero-maintenance sites
  • Anyone relying on long-term vendor support
  • Security-sensitive business or e-commerce sites
  • Simple sites — free themes are enough

Gotchas - check before you buy

high

Author churn: when a developer quits, updates and support stop — your site carries the risk

high

Buyers report stuck on unpatched, max-severity CVEs in purchased themes with no fix

medium

Refunds are policy-driven, not guaranteed; buyers report denials on bad themes

medium

Multipurpose themes often load slowly; buyers report caching and performance headaches

Pros and cons

Pros

  • Enormous catalog: thousands of WordPress, HTML, and email templates
  • One-time per-theme pricing; no subscription required
  • Low entry cost: full themes around $55–$69
  • Best-seller rankings help spot popular, proven themes

Cons

  • Developer churn leaves themes abandoned without updates
  • Sold themes shipped serious vulnerabilities, including RCE and auth bypass
  • Refund and review policies draw repeated buyer complaints
  • Support quality widely criticized, worsens when authors quit
  • Themes routinely called bloated; many developers avoid them

Sources & method

- 10 sources - Marketplace themes carry multiple published CVEs, including RCE and auth bypass; ThemeForest's own security page returned nothing.

official x1review x4security x3news x2
  • Alone WordPress theme RCE (CVE-2025-5393), Remote code execution vulnerability in a ThemeForest-sold theme.
  • AdForest theme authentication bypass (CVE-2025-8359), Commercial classifieds theme sold on ThemeForest affected.
  • Meks ThemeForest Smart Widget XSS (CVE-2024-33694), Stored cross-site scripting in a related WordPress plugin.
  • Buyers stuck on unpatched severity-10 CVE, Reddit users report purchased theme vulnerability with no fix available.

Key stats

  • Value for money: 3/5

    Rating

  • ~$55–$69 in reviewed examples

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 3/5. Cheap upfront; maintenance costs bite later
  • Ease of use: 3/5. Purchase is easy; bloated themes complicate setup
  • Feature depth: 4/5. Multipurpose themes pack extensive features
  • Support quality: 2/5. Authors abandon products; refunds contested
  • Security posture: 1/5. Multiple CVEs, including RCE, in sold themes
  • 1000s Theme catalog WordPress, HTML, email templates
  • $55–$69 Example theme prices e.g. Bridge theme listed at $69
  • No Free tier Per-item purchases only
  • 5 Theme CVEs cited In marketplace-sold themes, 2024–2026

Pricing

Per-theme regular license

~$55–$69 in reviewed examples

  • One-time purchase per theme
  • Single end product use
  • Extended support may cost extra

Security

Marketplace themes carry multiple published CVEs, including RCE and auth bypass; ThemeForest's own security page returned nothing.

  • Alone WordPress theme RCE (CVE-2025-5393)Remote code execution vulnerability in a ThemeForest-sold theme.⁶
  • AdForest theme authentication bypass (CVE-2025-8359)Commercial classifieds theme sold on ThemeForest affected.⁷
  • Meks ThemeForest Smart Widget XSS (CVE-2024-33694)Stored cross-site scripting in a related WordPress plugin.
  • Buyers stuck on unpatched severity-10 CVEReddit users report purchased theme vulnerability with no fix available.

What users say

Reddit and Trustpilot reviewers frequently criticize theme bloat, author abandonment, and refund friction, while some buyers report acceptable experiences.

Full analysis

Based on ~30 public sources: Reddit and Trustpilot reviews, security advisories, and marketplace pages. Many snippets truncated; user quotes unavailable verbatim.

Huge, cheap theme marketplace — but abandoned themes, CVEs, and weak support make it risky for non-developers.

Methodology

Based on ~30 public sources: Reddit and Trustpilot reviews, security advisories, and marketplace pages. Many snippets truncated; user quotes unavailable verbatim.

Read how a report is made.

Sources

  1. Why people hate themeforest themes so much? : r/Wordpressreddit.com
    review
  2. Envato Market: ThemeForest Reviews — Trustpilottrustpilot.com
    review
  3. Is ThemeForest Worth It? Honest Review of Themes & Supportbigcloudy.com
    review
  4. 8 reasons we almost never use ThemeForest Themescontentsnare.com
    review
  5. Themeforest has a developer churn..and it will (badly) hurtnextbigwhat.com
    news
  6. CVE-2025-5393: Alone WordPress Theme RCE Vulnerabilitysentinelone.com
    security
  7. AdForest WordPress Theme CVE-2025-8359zeropath.com
    security
  8. XSS Vulnerability: Buying or Selling on ThemeForest and CodeCanyonwptavern.com
    security
  9. ThemeForest — official sitethemeforest.net
    official
  10. 5 Years of Selling on ThemeForest – Pros and Conskinsta.com
    news

Add this review to your site

This check for ThemeForest says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends ThemeForest Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.