# cve.now: Themehunk

The newest entries naming Themehunk as an affected vendor (up to 200), of 39 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-111838](https://cve.now/CVE-2026-111838.md): WordPress ThemeHunk Customizer plugin \<= 2.8.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-105883](https://cve.now/CVE-2026-105883.md): WordPress Th Shop Mania theme \<= 1.9.1 - Broken Access Control vulnerability (CVSS 7.1)
- [CVE-2026-66607](https://cve.now/CVE-2026-66607.md): WordPress Advance Product Search plugin \<= 1.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-12753](https://cve.now/CVE-2026-12753.md): Advance Product Search- Voice & Ajax Search for WooCommerce \<= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter (CVSS 7.5)
- [CVE-2026-57405](https://cve.now/CVE-2026-57405.md): WordPress Open Shop theme \<= 1.7.1 - Broken Access Control vulnerability (CVSS 7.1)
- [CVE-2026-14250](https://cve.now/CVE-2026-14250.md): Themehunk Login Registration \<= 1.0.2 - Unauthenticated Privilege Escalation via 'role' Parameter (CVSS 6.3)
- [CVE-2026-56070](https://cve.now/CVE-2026-56070.md): WordPress Advance Product Search plugin \<= 1.4.4 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2023-25969](https://cve.now/CVE-2023-25969.md): WordPress Contact Form & Lead Form Elementor Builder plugin \<= 1.8.4 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-32532](https://cve.now/CVE-2026-32532.md): WordPress Contact Form & Lead Form Elementor Builder plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-25438](https://cve.now/CVE-2026-25438.md): WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin \<= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-1454](https://cve.now/CVE-2026-1454.md): Responsive Contact Form Builder & Lead Generation Plugin \<= 2.0.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2025-68046](https://cve.now/CVE-2025-68046.md): WordPress Contact Form & Lead Form Elementor Builder plugin \<= 2.0.1 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2025-69344](https://cve.now/CVE-2025-69344.md): WordPress Oneline Lite theme \<= 6.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-12040](https://cve.now/CVE-2025-12040.md): Wishlist for WooCommerce \<= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation (CVSS 6.5)
- [CVE-2025-62902](https://cve.now/CVE-2025-62902.md): WordPress WP Popup Builder plugin \<= 1.3.8 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2025-9378](https://cve.now/CVE-2025-9378.md): Vayu Blocks \<= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes (CVSS 6.4)
- [CVE-2025-52816](https://cve.now/CVE-2025-52816.md): WordPress Zita theme \<= 1.6.5 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-30990](https://cve.now/CVE-2025-30990.md): WordPress ThemeHunk plugin \<= 1.2.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-4420](https://cve.now/CVE-2025-4420.md): Vayu Blocks \<= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameter (CVSS 6.4)
- [CVE-2025-2568](https://cve.now/CVE-2025-2568.md): Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update (CVSS 5.3)
- [CVE-2025-22644](https://cve.now/CVE-2025-22644.md): WordPress Vayu Blocks – Gutenberg Blocks plugin \<= 1.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-30881](https://cve.now/CVE-2025-30881.md): WordPress Big Store theme \<= 2.0.8 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-13511](https://cve.now/CVE-2024-13511.md): Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset (CVSS 4.3)
- [CVE-2024-54369](https://cve.now/CVE-2024-54369.md): WordPress Zita Site Builder plugin \<= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability (CVSS 9.1)
- [CVE-2024-10124](https://cve.now/CVE-2024-10124.md): Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce \<= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation (CVSS 9.8)
- [CVE-2023-28688](https://cve.now/CVE-2023-28688.md): WordPress TH Variation Swatches plugin \<= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2024-10674](https://cve.now/CVE-2024-10674.md): Th Shop Mania \<= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation (CVSS 8.8)
- [CVE-2024-10673](https://cve.now/CVE-2024-10673.md): Top Store \<= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation (CVSS 8.8)
- [CVE-2024-9061](https://cve.now/CVE-2024-9061.md): WP Popup Builder – Popup Forms and Marketing Lead Generation \<= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp\_ajax\_nopriv\_shortcode\_Api\_Add (CVSS 7.3)
- [CVE-2024-9707](https://cve.now/CVE-2024-9707.md): Hunk Companion \<= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation (CVSS 9.8)
- [CVE-2024-8433](https://cve.now/CVE-2024-8433.md): Easy Mega Menu Plugin for WordPress – ThemeHunk \<= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-8434](https://cve.now/CVE-2024-8434.md): Easy Mega Menu Plugin for WordPress – ThemeHunk \<= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings Updates (CVSS 4.3)
- [CVE-2024-44049](https://cve.now/CVE-2024-44049.md): WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin \<= 1.2.8 - Authenticated Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-4261](https://cve.now/CVE-2024-4261.md): Responsive Contact Form Builder & Lead Generation Plugin \<= 1.9.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4)
- [CVE-2022-40218](https://cve.now/CVE-2022-40218.md): WordPress TH Advance Product Search plugin \<= 1.1.4 - Unauthenticated Plugin Settings Change vulnerability (CVSS 6.5)
- [CVE-2024-1415](https://cve.now/CVE-2024-1415.md): Responsive Contact Form Builder & Lead Generation Plugin \<= 1.8.9 - Cross-Site Request Forgery (CVSS 4.3)
- [CVE-2024-1416](https://cve.now/CVE-2024-1416.md): Responsive Contact Form Builder & Lead Generation Plugin \<= 1.8.9 - Missing Authorization (CVSS 4.3)
- [CVE-2022-38057](https://cve.now/CVE-2022-38057.md): WordPress TH Advance Product Search plugin \<= 1.2.1 - Unauthenticated Plugin Settings Reset vulnerability (CVSS 6.5)
- [CVE-2023-27431](https://cve.now/CVE-2023-27431.md): WordPress Big Store Theme \<= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/themehunk
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.