Hashthemes vulnerabilities
32 CVEs and advisories name Hashthemes as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-81780WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
- CVE-2026-78292WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
- CVE-2026-78280WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-28164WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-65483WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24618WordPress Hash Elements plugin <= 1.5.4 - Sensitive Data Exposure vulnerability
- CVE-2026-5077Total <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute
- CVE-2026-6370WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-9045Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2025-58973WordPress Easy Elementor Addons Plugin <= 2.2.8 - Local File Inclusion Vulnerability
- CVE-2025-59561WordPress Smart Blocks Plugin <= 2.4 - Broken Access Control Vulnerability
- CVE-2025-54712WordPress Easy Elementor Addons Plugin <= 2.2.7 - Broken Access Control Vulnerability
- CVE-2025-54704WordPress Easy Elementor Addons plugin <= 2.2.6 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-48295WordPress Easy Elementor Addons plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-47468WordPress Hash Form plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerability
- CVE-2025-26912WordPress Easy Elementor Addons plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-26761WordPress Easy Elementor Addons plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-22296WordPress Hash Elements plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2023-28990WordPress Viral Mag theme <= 1.0.9 - Authenticated Arbitrary Plugin Activation Vulnerability
- CVE-2023-27456WordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin Activation
- CVE-2024-12201Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation
- CVE-2023-30486WordPress Square theme <= 2.0.0 - Broken Access Control
- CVE-2024-10802Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure
- CVE-2024-49270WordPress Smart Blocks plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-9417Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload
- CVE-2024-5084Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
- CVE-2024-5085Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection
- CVE-2024-5177Hash Elements <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgets
- CVE-2024-30426WordPress Hash Elements plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2023-33923Broken Access Control leading to Arbitrary Plugin Activation in multiple HashThemes themes