Hasthemes vulnerabilities

Products

• Ht Mega 30
• Shoplentor 21
• Woolentor - Woocommerce Elementor Addons \+ Builder 4
• Download Contact Form 7 Widget For Elementor Page Builder \& Gutenberg Blocks 3
• Extensions For Cf7 3
• Hashbar – Wordpress Notification Bar 3
• Ht Easy Ga4 \(google Analytics 4\) 3
• Wishsuite 3
• Hashbar 2
• Ht Easy Ga4 ( Google Analytics 4 ) 2
• Ht Feed 2
• Ht Feed 2
• Ht Mega – Absolute Addons For Elementor 2
• Ht Mega - Absolute Addons For Elementor Page Builder 2
• Ht Menu 2
• Ht Politic 2
• Wc Builder 2
• Wc Builder 2
• Wp Education 2
• Wp Plugin Manager 2
• Wp Plugin Manager 2

Newest

• devitems hashbar – wordpress notification bar WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerability CVE-2026-94117 7.6 HighSeptember 22, 2026
• hasthemes ht menu HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings CVE-2026-84935 8.0 HighSeptember 5, 2026
• hasthemes swatchly – woocommerce variation swatches for products WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability CVE-2026-66605 7.1 HighAugust 20, 2026
• devitems hashbar – wordpress notification bar WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-66602 8.8 HighAugust 18, 2026
• hasthemes wc builder WordPress WC Builder plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability CVE-2025-68533 6.5 MediumDecember 24, 2025
• hasthemes wc builder – woocommerce page builder for wpbakery WC Builder <= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode Attribute CVE-2025-14054 4.4 MediumDecember 21, 2025
• hasthemes wp plugin manager WordPress WP Plugin Manager plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-64271 4.3 MediumNovember 13, 2025
• hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 more ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template' CVE-2025-12493 9.8 CriticalNovember 4, 2025
• hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 more ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-11823 6.4 MediumOctober 25, 2025
• devitems shoplentor WordPress ShopLentor Plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerability CVE-2025-58990 6.5 MediumSeptember 9, 2025
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions CVE-2025-8068 4.3 MediumJuly 31, 2025
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure CVE-2025-8401 4.3 MediumJuly 31, 2025
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions CVE-2025-8151 4.3 MediumJuly 31, 2025
• hasthemes download contact form 7 widget for elementor page builder \& gutenberg blocks, htplugins ht contact form – drag & drop form builder for wordpress +1 more HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload CVE-2025-7340 Public exploit 9.8 CriticalJuly 15, 2025
• hasthemes download contact form 7 widget for elementor page builder \& gutenberg blocks, htplugins ht contact form – drag & drop form builder for wordpress +1 more HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move CVE-2025-7360 9.1 CriticalJuly 15, 2025
• hasthemes download contact form 7 widget for elementor page builder \& gutenberg blocks, htplugins ht contact form – drag & drop form builder for wordpress +1 more HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion CVE-2025-7341 9.1 CriticalJuly 15, 2025
• hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 more ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter CVE-2025-3775 6.5 MediumApril 25, 2025
• hasthemes swatchly – woocommerce variation swatches for products (product attributes: image swatch, color swatches, label swatches) Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited O… CVE-2025-2719 6.5 MediumApril 10, 2025
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVE-2025-1802 6.4 MediumMarch 20, 2025
• hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 more ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flas… CVE-2025-1527 6.4 MediumMarch 12, 2025
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget CVE-2025-1261 6.4 MediumMarch 8, 2025
• hasthemes wp templata WordPress WP Templata plugin <= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-26917 7.1 HighMarch 3, 2025
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget CVE-2024-12599 6.4 MediumFebruary 11, 2025
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css CVE-2024-12597 6.4 MediumFebruary 4, 2025
• hasthemes extensions for cf7 WordPress Extensions For CF7 Plugin <= 3.2.0 - Server Side Request Forgery (SSRF) vulnerability CVE-2025-24695 4.4 MediumJanuary 24, 2025
• hasthemes free woocommerce theme 99fy extension WordPress Free WooCommerce Theme 99fy Extension plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability CVE-2025-22801 6.5 MediumJanuary 9, 2025
• devitems ht politic WordPress HT Politic plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability CVE-2024-51673 6.5 MediumNovember 9, 2024
• hasthemes ht builder – wordpress theme builder for elementor, ht builder +1 more WordPress HT Builder – WordPress Theme Builder for Elementor plugin <= 1.3.0 - Stored Cross Site Scripting (XSS) vulnerability CVE-2024-51682 6.5 MediumNovember 4, 2024
• devitems wp education WordPress WP Education for Elementor plugin <= 1.2.8 - Stored Cross Site Scripting (XSS) vulnerability CVE-2024-49630 6.5 MediumOctober 20, 2024
• hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 more ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template CVE-2024-9538 4.3 MediumOctober 11, 2024
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id CVE-2024-8910 4.3 MediumSeptember 25, 2024
• devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin, hasthemes woolentor - woocommerce elementor addons \+ builder +1 more ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting CVE-2024-8668 6.4 MediumSeptember 25, 2024
• devitems ht mega WordPress HT Mega plugin <= 2.5.7 - JSON Path Traversal vulnerability CVE-2024-38706 6.5 MediumJuly 12, 2024
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVE-2024-5215 6.4 MediumJune 26, 2024
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings CVE-2024-5173 6.4 MediumJune 26, 2024
• hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 more ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Hor… CVE-2024-5530 6.4 MediumJune 11, 2024
• hasthemes ht feed, ht plugins feed +1 more WordPress HT Feed plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability CVE-2024-35699 6.5 MediumJune 8, 2024
• hastech shoplentor WordPress ShopLentor plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability CVE-2024-34767 6.5 MediumJune 3, 2024
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4876 6.4 MediumMay 21, 2024
• hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 more ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification CVE-2024-4566 7.1 HighMay 21, 2024
• hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 more ShopLentor <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode CVE-2024-3345 6.4 MediumMay 21, 2024
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update CVE-2024-4875 Public exploit 4.3 MediumMay 21, 2024
• hastech ht mega, hasthemes ht mega - absolute addons for elementor page builder +1 more WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability CVE-2023-37999 9.8 CriticalMay 17, 2024
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget CVE-2024-3990 6.4 MediumMay 9, 2024
• hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 more ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products CVE-2023-6327 5.3 MediumMay 9, 2024
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify CVE-2024-3989 6.4 MediumMay 9, 2024
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget CVE-2024-3307 6.4 MediumMay 2, 2024
• hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 more HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget CVE-2024-2084 6.4 MediumMay 2, 2024
• hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 more ShopLentor <= 2.8.1 - Improper Authorization via woolentor_template_store CVE-2023-7067 4.3 MediumMay 2, 2024
• hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 more ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _id CVE-2024-3991 6.4 MediumMay 2, 2024
• Show olderLoading…