Read the docs

themehunk

Records47All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical9CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

themehunk records in CISA KEV

No themehunk vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Contact Form & Lead Form Elementor Builder 5 records MEDIUM Wp Popup Builder 4 records HIGH Big Store 2 records LOW Hunk Companion 2 records HIGH Mega Menu 2 records LOW Advance Product Search 1 record MEDIUM Gutenberg Blocks 1 record LOW Th Advance Product Search 1 record MEDIUM

Records

4 records in Wp Popup Builder · all components

TI-2024-08412 CVE-2024-9061 · GHSA-fvv3-x64f-px6p

Code injection in themehunk WP Popup Builder – Popup Forms and Marketing Lead Generation

Priority HIGH 80

The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and inc…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.52266 Published 2024-10-16 No fix listed CWE-94
TI-2022-02219 CVE-2022-2404 · GHSA-j2hx-526f-q8h2

WP Popup Builder < 1.2.9 - Reflected Cross-Site Scripting

Priority MEDIUM 60

The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00626 Published 2022-09-26 Fixed in 1.2.9 CWE-79
TI-2022-02220 CVE-2022-2405 · GHSA-wmh8-mcwp-x84h

WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion

Priority MEDIUM 53

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00319 Published 2022-09-26 Fixed in 1.2.9 CWE-352
TI-2025-39051 CVE-2025-62902 · GHSA-253g-qmmx-2x98

WordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerability

Priority LOW 30

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedded Sensitive Data.This issue affects WP Popup Builder: from n/…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00306 Published 2025-10-27 No fix listed CWE-497
Open these records in search →