# cve.now: Hashthemes

The newest entries naming Hashthemes as an affected vendor (up to 200), of 32 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-81780](https://cve.now/CVE-2026-81780.md): WordPress Hash Form plugin \<= 1.4.2 - Arbitrary File Upload vulnerability (CVSS 10.0)
- [CVE-2026-78292](https://cve.now/CVE-2026-78292.md): WordPress Hash Form plugin \<= 1.4.1 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-78280](https://cve.now/CVE-2026-78280.md): WordPress Hash Form plugin \<= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2026-28164](https://cve.now/CVE-2026-28164.md): WordPress Easy Elementor Addons plugin \<= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 9.6)
- [CVE-2026-65483](https://cve.now/CVE-2026-65483.md): WordPress HashThemes Demo Importer plugin \<= 1.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2026-24618](https://cve.now/CVE-2026-24618.md): WordPress Hash Elements plugin \<= 1.5.4 - Sensitive Data Exposure vulnerability (CVSS 4.3)
- [CVE-2026-5077](https://cve.now/CVE-2026-5077.md): Total \<= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute (CVSS 5.4)
- [CVE-2026-6370](https://cve.now/CVE-2026-6370.md): WordPress Mini Ajax Cart for WooCommerce plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-9045](https://cve.now/CVE-2025-9045.md): Easy Elementor Addons \<= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-58973](https://cve.now/CVE-2025-58973.md): WordPress Easy Elementor Addons Plugin \<= 2.2.8 - Local File Inclusion Vulnerability (CVSS 7.5)
- [CVE-2025-59561](https://cve.now/CVE-2025-59561.md): WordPress Smart Blocks Plugin \<= 2.4 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-54712](https://cve.now/CVE-2025-54712.md): WordPress Easy Elementor Addons Plugin \<= 2.2.7 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-54704](https://cve.now/CVE-2025-54704.md): WordPress Easy Elementor Addons plugin \<= 2.2.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-48295](https://cve.now/CVE-2025-48295.md): WordPress Easy Elementor Addons plugin \<= 2.2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-47468](https://cve.now/CVE-2025-47468.md): WordPress Hash Form plugin \<= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-26912](https://cve.now/CVE-2025-26912.md): WordPress Easy Elementor Addons plugin \<= 2.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-26761](https://cve.now/CVE-2025-26761.md): WordPress Easy Elementor Addons plugin \<= 2.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-22296](https://cve.now/CVE-2025-22296.md): WordPress Hash Elements plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2023-28990](https://cve.now/CVE-2023-28990.md): WordPress Viral Mag theme \<= 1.0.9 - Authenticated Arbitrary Plugin Activation Vulnerability (CVSS 4.3)
- [CVE-2023-27456](https://cve.now/CVE-2023-27456.md): WordPress Total theme \<= 2.1.19 - Authenticated Arbitrary Plugin Activation (CVSS 4.3)
- [CVE-2024-12201](https://cve.now/CVE-2024-12201.md): Hash Form \<= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation (CVSS 4.3)
- [CVE-2023-30486](https://cve.now/CVE-2023-30486.md): WordPress Square theme \<= 2.0.0 - Broken Access Control (CVSS 4.3)
- [CVE-2024-10802](https://cve.now/CVE-2024-10802.md): Hash Elements \<= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure (CVSS 5.3)
- [CVE-2024-49270](https://cve.now/CVE-2024-49270.md): WordPress Smart Blocks plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-9417](https://cve.now/CVE-2024-9417.md): Hash Form - Drag & Drop Form Builder \<= 1.1.9 - Unauthenticated Limited File Upload (CVSS 6.1)
- [CVE-2024-5084](https://cve.now/CVE-2024-5084.md): Hash Form – Drag & Drop Form Builder \<= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution (CVSS 9.8)
- [CVE-2024-5085](https://cve.now/CVE-2024-5085.md): Hash Form – Drag & Drop Form Builder \<= 1.1.0 - Unauthenticated PHP Object Injection (CVSS 8.1)
- [CVE-2024-5177](https://cve.now/CVE-2024-5177.md): Hash Elements \<= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgets (CVSS 6.4)
- [CVE-2024-30426](https://cve.now/CVE-2024-30426.md): WordPress Hash Elements plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2023-33923](https://cve.now/CVE-2023-33923.md): Broken Access Control leading to Arbitrary Plugin Activation in multiple HashThemes themes (CVSS 4.3)
- [CVE-2024-1771](https://cve.now/CVE-2024-1771.md): Total \<= 2.1.59 - Missing Authorization to Authenticated (Subscriber+) Sections Update (CVSS 4.3)
- [CVE-2021-39333](https://cve.now/CVE-2021-39333.md): Hashthemes Demo Importer \<= 1.1.1 Improper Access Control Allowing Content Deletion (CVSS 8.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/hashthemes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.