Skip to content

Themehunk vulnerabilities

Products

Newest

themehunk customizer WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability CVE-2026-111838 7.1 HighOctober 21, 2026
themehunk th shop mania WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability CVE-2026-105883 7.1 HighOctober 9, 2026
themehunk advance product search WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability CVE-2026-66607 7.1 HighAugust 20, 2026
themehunk advance product search- voice & ajax search for woocommerce Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter CVE-2026-12753 7.5 HighJuly 16, 2026
themehunk open shop WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability CVE-2026-57405 7.1 HighJuly 13, 2026
themehunk th login registration Themehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation via 'role' Parameter CVE-2026-14250 6.3 MediumJuly 8, 2026
themehunk advance product search WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability CVE-2026-56070 9.3 CriticalJune 26, 2026
themehunk contact form & lead form elementor builder WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability CVE-2023-25969 5.4 MediumJune 11, 2026
themehunk contact form & lead form elementor builder WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-32532 7.1 HighMarch 25, 2026
themehunk gutenberg blocks WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-25438 7.1 HighMarch 19, 2026
themehunk lead form builder & contact form Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting CVE-2026-1454 7.2 HighMarch 11, 2026
themehunk contact form & lead form elementor builder WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability CVE-2025-68046 6.5 MediumJanuary 22, 2026
themehunk oneline lite WordPress Oneline Lite theme <= 6.6 - Broken Access Control vulnerability CVE-2025-69344 4.3 MediumJanuary 7, 2026
themehunk wishlist for woocommerce Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation CVE-2025-12040 6.5 MediumNovember 25, 2025
themehunk wp popup builder WordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerability CVE-2025-62902 5.3 MediumOctober 27, 2025
themehunk vayu blocks – website builder for the block editor Vayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes CVE-2025-9378 6.4 MediumSeptember 3, 2025
publishpress gutenberg blocks WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion Vulnerability CVE-2025-48332 7.5 HighAugust 14, 2025
publishpress gutenberg blocks WordPress Gutenberg Blocks plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability CVE-2025-49032 6.5 MediumJuly 3, 2025
themehunk zita WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability CVE-2025-52816 8.1 HighJune 27, 2025
themehunk, themehunk mega menu +1 more WordPress ThemeHunk plugin <= 1.2.0 - Broken Access Control vulnerability CVE-2025-30990 4.3 MediumJune 6, 2025
themehunk vayu blocks – website builder for the block editor Vayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameter CVE-2025-4420 6.4 MediumJune 3, 2025
unknown responsive contact form builder & lead generation plugin, themehunk contact form \& lead form elementor builder +1 more Lead Form Builder < 1.9.8 - Admin+ Stored XSS CVE-2024-10475 4.8 MediumMay 15, 2025
themehunk vayu blocks – gutenberg blocks for wordpress & woocommerce Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update CVE-2025-2568 Public exploit 5.3 MediumApril 8, 2025
themehunk vayu blocks – gutenberg blocks for wordpress & woocommerce, vayu blocks +1 more WordPress Vayu Blocks – Gutenberg Blocks plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability CVE-2025-22644 6.5 MediumMarch 27, 2025
themehunk big store WordPress Big Store theme <= 2.0.8 - Broken Access Control vulnerability CVE-2025-30881 4.3 MediumMarch 27, 2025
themehunk variation swatches for woocommerce, variation swatches for woocommerce swatches for woocommerce +1 more Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset CVE-2024-13511 4.3 MediumJanuary 23, 2025
themehunk hunk companion Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation CVE-2024-11972 Public exploit EPSS 59.1% 9.8 CriticalDecember 31, 2024
themehunk zita site builder WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability CVE-2024-54369 Public exploit 9.1 CriticalDecember 16, 2024
themehunk vayu blocks – website builder for the block editor Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation CVE-2024-10124 Public exploit EPSS 32.7% 9.8 CriticalDecember 12, 2024
themehunk th variation swatches, variation swatches +1 more WordPress TH Variation Swatches plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerability CVE-2023-28688 5.4 MediumDecember 9, 2024
themehunk th shop mania Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation CVE-2024-10674 Public exploit 8.8 HighNovember 9, 2024
themehunk top store Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation CVE-2024-10673 Public exploit 8.8 HighNovember 9, 2024
themehunk wp popup builder – popup forms and marketing lead generation, wp popup builder +1 more WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add CVE-2024-9061 Public exploit EPSS 52.3% 7.3 HighOctober 16, 2024
themehunk hunk companion Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation CVE-2024-9707 Public exploit 9.8 CriticalOctober 11, 2024
themehunk easy mega menu for wordpress – themehunk Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-8433 6.4 MediumOctober 8, 2024
themehunk mega menu, easy mega menu for wordpress – themehunk +1 more Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings Updates CVE-2024-8434 4.3 MediumSeptember 25, 2024
themehunk gutenberg blocks WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Authenticated Cross Site Scripting (XSS) vulnerability CVE-2024-44049 6.5 MediumSeptember 17, 2024
themehunk lead form builder & contact form Responsive Contact Form Builder & Lead Generation Plugin <= 1.9.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution CVE-2024-4261 5.4 MediumMay 22, 2024
themehunk advance wordpress search plugin, advance product search, advanced wordpress search +2 more WordPress TH Advance Product Search plugin <= 1.1.4 - Unauthenticated Plugin Settings Change vulnerability CVE-2022-40218 6.5 MediumMay 8, 2024
unknown responsive contact form builder & lead generation plugin, themehunk contact form \& lead form elementor builder +1 more Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Admin+ Stored XSS CVE-2024-3637 6.1 MediumMay 3, 2024
themehunk lead form builder & contact form, wordpress responsive contact form builder lead generation +1 more Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Cross-Site Request Forgery CVE-2024-1415 4.3 MediumMay 2, 2024
themehunk lead form builder & contact form Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Missing Authorization CVE-2024-1416 4.3 MediumMay 2, 2024
themehunk advance wordpress search plugin, th advance product search, advanced wordpress search +2 more WordPress TH Advance Product Search plugin <= 1.2.1 - Unauthenticated Plugin Settings Reset vulnerability CVE-2022-38057 6.5 MediumMarch 25, 2024
themehunk contact form & lead form elementor builder, contact form \& lead form elementor builder +1 more Contact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings Update CVE-2022-23180 4.3 MediumJanuary 16, 2024
themehunk contact form & lead form elementor builder, contact form \& lead form elementor builder +1 more Contact Form & Lead Form Elementor Builder < 1.7.0 - Multiple Admin+ Stored Cross-Site Scripting CVE-2022-23179 4.8 MediumJanuary 16, 2024
themehunk big store WordPress Big Store Theme <= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-27431 4.3 MediumNovember 12, 2023
themehunk wp popup builder, unknown wp popup builder – popup forms , marketing popup & newsletter +1 more WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion CVE-2022-2405 4.3 MediumSeptember 26, 2022
themehunk wp popup builder, unknown wp popup builder – popup forms , marketing popup & newsletter +1 more WP Popup Builder < 1.2.9 - Reflected Cross-Site Scripting CVE-2022-2404 6.1 MediumSeptember 26, 2022
themehunk contact form & lead form elementor builder, contact form \& lead form elementor builder +1 more Contact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site Scripting CVE-2021-24967 6.1 MediumDecember 27, 2021