Themehunk vulnerabilities
39 CVEs and advisories name Themehunk as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-111838WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105883WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability
- CVE-2026-66607WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-12753Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter
- CVE-2026-57405WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability
- CVE-2026-14250Themehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation via 'role' Parameter
- CVE-2026-56070WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability
- CVE-2023-25969WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability
- CVE-2026-32532WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25438WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-1454Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting
- CVE-2025-68046WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability
- CVE-2025-69344WordPress Oneline Lite theme <= 6.6 - Broken Access Control vulnerability
- CVE-2025-12040Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
- CVE-2025-62902WordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerability
- CVE-2025-9378Vayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes
- CVE-2025-52816WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability
- CVE-2025-30990WordPress ThemeHunk plugin <= 1.2.0 - Broken Access Control vulnerability
- CVE-2025-4420Vayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameter
- CVE-2025-2568Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update
- CVE-2025-22644WordPress Vayu Blocks – Gutenberg Blocks plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-30881WordPress Big Store theme <= 2.0.8 - Broken Access Control vulnerability
- CVE-2024-13511Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset
- CVE-2024-54369WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability
- CVE-2024-10124Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
- CVE-2023-28688WordPress TH Variation Swatches plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerability
- CVE-2024-10674Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
- CVE-2024-10673Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
- CVE-2024-9061WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add
- CVE-2024-9707Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation