Themehunk
44 CVEs across 34 Themehunk products. Browse Themehunk vulnerabilities, severities, and proof-of-concept exploits.
Themehunk products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12753 | High | 7.5 | 2026-07-16 | The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter i… |
CVE-2026-57405 | High | 7.1 | 2026-07-13 | Missing Authorization vulnerability in themehunk Open Shop open-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-14250 | Medium | 6.3 | 2026-07-08 | The Themehunk Login Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.2. This is due to the handle_… |
CVE-2026-56070 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. |
CVE-2023-25969 | Medium | 5.4 | 2026-06-11 | Missing Authorization vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-32532 | High | 7.1 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead… |
CVE-2026-25438 | High | 7.1 | 2026-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks allows Reflec… |
CVE-2026-1454 | High | 7.2 | 2026-03-11 | The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and inclu… |
CVE-2025-68046 | Medium | 6.5 | 2026-01-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-buil… |
CVE-2025-69344 | Medium | 4.3 | 2026-01-07 | Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-12040 | Medium | 6.5 | 2025-11-25 | The Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.3 via several fun… |
CVE-2025-62902 | Medium | 5.3 | 2025-10-27 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedde… |
CVE-2025-9378 | Medium | 6.4 | 2025-09-03 | The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie… |
CVE-2025-52816 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehunk Zita zita allows PHP Local F… |
CVE-2025-30990 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in ThemeHunk ThemeHunk themehunk-megamenu-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-4420 | Medium | 6.4 | 2025-06-03 | The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerWidth’ param… |
CVE-2024-10475 | Medium | 4.8 | 2025-05-15 | The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow… |
CVE-2025-2568 | Medium | 5.3 | 2025-04-08 | The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification of data due to missin… |
CVE-2025-22644 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress &… |
CVE-2025-30881 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in themehunk Big Store big-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-13511 | Medium | 4.3 | 2025-01-23 | The Variation Swatches for WooCommerce plugin, in all versions starting at 1.0.8 up until 1.3.2, contains a vulnerability due to improper nonce verification in… |
CVE-2024-11972 | Critical | 9.8 | 2024-12-31 | The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activat… |
CVE-2024-54369 | Critical | 9.1 | 2024-12-16 | Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue a… |
CVE-2024-10124 | Critical | 9.8 | 2024-12-12 | The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation… |
CVE-2023-28688 | Medium | 5.4 | 2024-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches… |
CVE-2024-10674 | High | 8.8 | 2024-11-09 | The Th Shop Mania theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the th_shop_mania_instal… |
CVE-2024-10673 | High | 8.8 | 2024-11-09 | The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the top_store_install_and_ac… |
CVE-2024-9061 | High | 7.3 | 2024-10-16 | The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv… |
CVE-2024-9707 | Critical | 9.8 | 2024-10-11 | The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/th… |
CVE-2024-8433 | Medium | 6.4 | 2024-10-08 | The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunk_megamenu_bg_image' par… |
CVE-2024-8434 | Medium | 4.3 | 2024-09-25 | The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several func… |
CVE-2024-44049 | Medium | 6.5 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks.This issue af… |
CVE-2024-4261 | Medium | 5.4 | 2024-05-22 | The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2022-40218 | Medium | 6.5 | 2024-05-08 | Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.1.4. |
CVE-2024-3637 | Medium | 6.1 | 2024-05-03 | The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allo… |
CVE-2024-1416 | Medium | 4.3 | 2024-05-02 | The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capabi… |
CVE-2024-1415 | Medium | 4.3 | 2024-05-02 | The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ… |
CVE-2022-38057 | Medium | 6.5 | 2024-03-25 | Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1. |
CVE-2022-23180 | Medium | 4.3 | 2024-01-16 | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated u… |
CVE-2022-23179 | Medium | 4.8 | 2024-01-16 | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, whic… |
CVE-2023-27431 | Medium | 4.3 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk Big Store theme <= 1.9.3 versions. |
CVE-2022-2405 | Medium | 4.3 | 2022-09-26 | The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subs… |
CVE-2022-2404 | Medium | 6.1 | 2022-09-26 | The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2021-24967 | Medium | 6.1 | 2021-12-27 | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated u… |