Hashthemes
27 CVEs across 17 Hashthemes products. Browse Hashthemes vulnerabilities, severities, and proof-of-concept exploits.
Hashthemes products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65483 | Medium | 5.9 | 2026-07-23 | Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions. |
CVE-2026-24618 | Medium | 4.3 | 2026-06-12 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HashThemes Hash Elements allows Retrieve Embedded Sensitive Data. … |
CVE-2026-5077 | Medium | 5.4 | 2026-05-02 | The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output e… |
CVE-2026-6370 | Medium | 5.9 | 2026-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored X… |
CVE-2025-9045 | Medium | 6.4 | 2025-10-03 | The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2… |
CVE-2025-59561 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in hashthemes Smart Blocks smart-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-58973 | High | 7.5 | 2025-09-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hashthemes Easy Elementor Addons easy-… |
CVE-2025-54712 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-54704 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons al… |
CVE-2025-48295 | Medium | 6.5 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons al… |
CVE-2025-47468 | Medium | 4.3 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in hashthemes Hash Form hash-form allows Cross Site Request Forgery.This issue affects Hash Form: from n/a thro… |
CVE-2025-26912 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons al… |
CVE-2025-26761 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons al… |
CVE-2025-22296 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Hash Elements hash-elements.This issue affects… |
CVE-2023-28990 | Medium | 4.3 | 2024-12-13 | Missing Authorization vulnerability in HashThemes Viral Mag allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Ma… |
CVE-2023-27456 | Medium | 4.3 | 2024-12-13 | Missing Authorization vulnerability in HashThemes Total allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total: from… |
CVE-2024-12201 | Medium | 4.3 | 2024-12-12 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles… |
CVE-2023-30486 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: fro… |
CVE-2024-10802 | Medium | 5.3 | 2024-11-13 | The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_i… |
CVE-2024-49270 | Medium | 6.5 | 2024-10-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Smart Blocks smart-blocks allows Stored XSS.Th… |
CVE-2024-9417 | Medium | 6.1 | 2024-10-05 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleU… |
CVE-2024-5085 | High | 8.1 | 2024-05-23 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserializa… |
CVE-2024-5084 | Critical | 9.8 | 2024-05-23 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_a… |
CVE-2024-5177 | Medium | 6.4 | 2024-05-23 | The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter within multiple widgets in all versions up to, and… |
CVE-2024-30426 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Hash Elements allows Stored XSS.This issue aff… |
CVE-2023-33923 | Medium | 4.3 | 2024-03-25 | Missing Authorization vulnerability in HashThemes Viral News, HashThemes Viral, HashThemes HashOne.This issue affects Viral News: from n/a through 1.4.5; Viral… |
CVE-2024-1771 | Medium | 4.3 | 2024-03-06 | The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sections() function in al… |
CVE-2021-39333 | High | 8.1 | 2021-11-01 | The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users fo… |