Vulnerabilities

Filters

Reset all

1 selected

32 records

Sort

Vendor: hashthemes Clear all filters

TI-2026-56416 CVE-2026-81780 · GHSA-chvv-mh28-xhg5

WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability

MEDIUM 49

Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00522 Published 2026-08-31 No fix listed CWE-434

TI-2026-54463 CVE-2026-78292 · GHSA-j565-hhqc-8rx3

WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability

MEDIUM 50

Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-08-27 No fix listed CWE-502

TI-2026-54452 CVE-2026-78280 · GHSA-gxfw-xx48-f69w

WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00142 Published 2026-08-24 No fix listed CWE-352

TI-2026-22504 CVE-2026-28164 · GHSA-cghh-6x9c-84pf

WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability

MEDIUM 42

Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00201 Published 2026-08-20 No fix listed CWE-352

TI-2026-46653 CVE-2026-65483 · GHSA-f8mr-gmgv-838m

WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

LOW 26

Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.0024 Published 2026-07-23 No fix listed CWE-79

TI-2026-19857 CVE-2026-24618 · GHSA-5gvj-r2g2-wv2x

WordPress Hash Elements plugin <= 1.5.4 - Sensitive Data Exposure vulnerability

LOW 19

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HashThemes Hash Elements allows Retrieve Embedded Sensitive Data.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00175 Published 2026-06-12 No fix listed CWE-497

TI-2026-04432 CVE-2026-5077 · GHSA-5gp4-hrgf-7vj6

Cross-site scripting in hashthemes Total

LOW 24

The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output escaping when rendering the_title() inside HTML attribute cont…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00194 Published 2026-05-02 No fix listed CWE-79

TI-2026-05589 CVE-2026-6370 · GHSA-rqjr-7g3f-hx8c

WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

LOW 25

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.This issue affects Mini Ajax Cart for WooCommerce: from n/…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00138 Published 2026-04-15 No fix listed CWE-79

TI-2025-08289 CVE-2025-9045 · GHSA-qv27-6w65-7294

Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 30

The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2.2.9 due to insufficient input sanitization and output escapi…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00346 Published 2025-10-03 No fix listed CWE-79

TI-2025-36617 CVE-2025-58973 · GHSA-mfq6-hw88-rgr5

WordPress Easy Elementor Addons Plugin <= 2.2.8 - Local File Inclusion Vulnerability

LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows PHP Local File Inclusion.This issue a…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0061 Published 2025-09-22 No fix listed CWE-98

TI-2025-37091 CVE-2025-59561 · GHSA-w2w2-fvc5-fxfg

WordPress Smart Blocks Plugin <= 2.4 - Broken Access Control Vulnerability

LOW 20

Missing Authorization vulnerability in hashthemes Smart Blocks smart-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Blocks: from n/a through <= 2.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00252 Published 2025-09-22 No fix listed CWE-862

TI-2025-34475 CVE-2025-54712 · GHSA-37j6-767f-6qq3

WordPress Easy Elementor Addons Plugin <= 2.2.7 - Broken Access Control Vulnerability

LOW 19

Missing Authorization vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Elementor Addons: from n/a thr…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00216 Published 2025-08-14 No fix listed CWE-862

TI-2025-34467 CVE-2025-54704 · GHSA-rrj6-p38g-v3xc

WordPress Easy Elementor Addons plugin <= 2.2.6 - Cross Site Scripting (XSS) Vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows DOM-Based XSS.This issue affects Easy Elementor Addons:…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00196 Published 2025-08-14 No fix listed CWE-79

TI-2025-30621 CVE-2025-48295 · GHSA-r5p6-m6rp-9297

WordPress Easy Elementor Addons plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: fro…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00245 Published 2025-07-16 No fix listed CWE-79

TI-2025-29965 CVE-2025-47468 · GHSA-5w7x-vhpr-4w9j

WordPress Hash Form plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in hashthemes Hash Form hash-form allows Cross Site Request Forgery.This issue affects Hash Form: from n/a through <= 1.2.8.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00168 Published 2025-05-07 No fix listed CWE-352

TI-2025-19783 CVE-2025-26912 · GHSA-4g3g-74f5-mm55

WordPress Easy Elementor Addons plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

LOW 28

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00256 Published 2025-02-25 No fix listed CWE-79

TI-2025-19677 CVE-2025-26761 · GHSA-36c4-6cpg-q42g

WordPress Easy Elementor Addons plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

LOW 28

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00234 Published 2025-02-16 No fix listed CWE-79

TI-2025-16200 CVE-2025-22296 · GHSA-mf5x-3qw7-x5m8

WordPress Hash Elements plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Hash Elements hash-elements.This issue affects Hash Elements: from n/a through <= 1.5.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00257 Published 2025-01-07 No fix listed CWE-79

TI-2023-13452 CVE-2023-28990 · GHSA-rrj2-pjjj-cxf2

WordPress Viral Mag theme <= 1.0.9 - Authenticated Arbitrary Plugin Activation Vulnerability

LOW 20

Missing Authorization vulnerability in HashThemes Viral Mag allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Mag: from n/a through 1.0.9.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0047 Published 2024-12-13 No fix listed CWE-862

TI-2023-12188 CVE-2023-27456 · GHSA-cw4w-742w-5qj9

WordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin Activation

LOW 20

Missing Authorization vulnerability in HashThemes Total allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total: from n/a through 2.1.19.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0047 Published 2024-12-13 No fix listed CWE-862

TI-2024-11316 CVE-2024-12201 · GHSA-pfgx-5cqm-92jc

Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation

LOW 20

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00379 Published 2024-12-12 No fix listed CWE-862

TI-2023-14322 CVE-2023-30486 · GHSA-hjr6-44rc-43vh

WordPress Square theme <= 2.0.0 - Broken Access Control

LOW 21

Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: from n/a through 2.0.0.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00754 Published 2024-12-09 No fix listed CWE-862

TI-2024-10014 CVE-2024-10802 · GHSA-334h-vcfc-hw2v

Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure

LOW 31

The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_id() function in all versions up to, and including, 1.4.7.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0063 Published 2024-11-13 No fix listed CWE-862

TI-2024-32863 CVE-2024-49270 · GHSA-w2mv-76hq-6267

WordPress Smart Blocks plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Smart Blocks smart-blocks allows Stored XSS.This issue affects Smart Blocks: from n/a through <= 2.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00268 Published 2024-10-16 No fix listed CWE-79

TI-2024-08738 CVE-2024-9417 · GHSA-94hp-f48v-qhx5

Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload

LOW 27

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00368 Published 2024-10-05 No fix listed CWE-434