Hasthemes vulnerabilities
26 CVEs and advisories name Hasthemes as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-66605WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-68533WordPress WC Builder plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-14054WC Builder <= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode Attribute
- CVE-2025-64271WordPress WP Plugin Manager plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2025-2719Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
- CVE-2025-26917WordPress WP Templata plugin <= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2025-22801WordPress Free WooCommerce Theme 99fy Extension plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-51682WordPress HT Builder – WordPress Theme Builder for Elementor plugin <= 1.3.0 - Stored Cross Site Scripting (XSS) vulnerability
- CVE-2024-35699WordPress HT Feed plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-34767WordPress ShopLentor plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2023-37999WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability
- CVE-2024-29926WordPress WC Builder plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-29094WordPress HT Easy GA4 plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-29102WordPress Extensions For CF7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerability
- CVE-2023-51529WordPress HT Mega Plugin <= 2.3.3 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-50901WordPress HT Mega Plugin <= 2.3.8 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-51372WordPress HashBar – WordPress Notification Bar Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2022-47172WordPress WooLentor Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-23791WordPress HT Menu Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-23803WordPress JustTables – WooCommerce Product Table Plugin <= 1.4.9 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-23792WordPress Swatchly – WooCommerce Variation Swatches for Products Plugin <= 1.2.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-23804WordPress HT Feed Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-23802WordPress HT Easy GA4 ( Google Analytics 4 ) Plugin <= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-23801WordPress Really Simple Google Tag Manager Plugin <= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2022-46798WordPress WooLentor Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-23899WordPress Extensions For CF7 Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)