In reply to Khoi Pro.

If you look at the Theme Directory they have for some time had a “Report this theme” button on each theme’s page where you can report issues with themes. Though when we used it to report that a theme contained a vulnerability due to an included plugin, the theme remained vulnerable and available long afterwards.