# cve.now: Hasthemes

The newest entries naming Hasthemes as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-66605](https://cve.now/CVE-2026-66605.md): WordPress Swatchly – WooCommerce Variation Swatches for Products plugin \<= 1.4.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-68533](https://cve.now/CVE-2025-68533.md): WordPress WC Builder plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-14054](https://cve.now/CVE-2025-14054.md): WC Builder \<= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading\_color' Shortcode Attribute (CVSS 4.4)
- [CVE-2025-64271](https://cve.now/CVE-2025-64271.md): WordPress WP Plugin Manager plugin \<= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-2719](https://cve.now/CVE-2025-2719.md): Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (CVSS 6.5)
- [CVE-2025-26917](https://cve.now/CVE-2025-26917.md): WordPress WP Templata plugin \<= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-22801](https://cve.now/CVE-2025-22801.md): WordPress Free WooCommerce Theme 99fy Extension plugin \<= 1.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-51682](https://cve.now/CVE-2024-51682.md): WordPress HT Builder – WordPress Theme Builder for Elementor plugin \<= 1.3.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-35699](https://cve.now/CVE-2024-35699.md): WordPress HT Feed plugin \<= 1.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-34767](https://cve.now/CVE-2024-34767.md): WordPress ShopLentor plugin \<= 2.8.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2023-37999](https://cve.now/CVE-2023-37999.md): WordPress HT Mega Absolute Addons for Elementor plugin \<= 2.2.0 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2024-29926](https://cve.now/CVE-2024-29926.md): WordPress WC Builder plugin \<= 1.0.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-29094](https://cve.now/CVE-2024-29094.md): WordPress HT Easy GA4 plugin \<= 1.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-29102](https://cve.now/CVE-2024-29102.md): WordPress Extensions For CF7 plugin \<= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2023-51529](https://cve.now/CVE-2023-51529.md): WordPress HT Mega Plugin \<= 2.3.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-50901](https://cve.now/CVE-2023-50901.md): WordPress HT Mega Plugin \<= 2.3.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-51372](https://cve.now/CVE-2023-51372.md): WordPress HashBar – WordPress Notification Bar Plugin \<= 1.4.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2022-47172](https://cve.now/CVE-2022-47172.md): WordPress WooLentor Plugin \<= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-23791](https://cve.now/CVE-2023-23791.md): WordPress HT Menu Plugin \<= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-23803](https://cve.now/CVE-2023-23803.md): WordPress JustTables – WooCommerce Product Table Plugin \<= 1.4.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-23792](https://cve.now/CVE-2023-23792.md): WordPress Swatchly – WooCommerce Variation Swatches for Products Plugin \<= 1.2.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-23804](https://cve.now/CVE-2023-23804.md): WordPress HT Feed Plugin \<= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-23802](https://cve.now/CVE-2023-23802.md): WordPress HT Easy GA4 ( Google Analytics 4 ) Plugin \<= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-23801](https://cve.now/CVE-2023-23801.md): WordPress Really Simple Google Tag Manager Plugin \<= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-46798](https://cve.now/CVE-2022-46798.md): WordPress WooLentor Plugin \<= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-23899](https://cve.now/CVE-2023-23899.md): WordPress Extensions For CF7 Plugin \<= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/hasthemes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.