Themehunk vulnerabilities
47 vulnerabilities
Known vulnerabilities in Themehunk products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 29 products.
Products
29- Contact Form \& Lead Form Elementor Builder8 vulnerabilities
- Lead Form Builder & Contact Form4 vulnerabilities
- Wp Popup Builder4 vulnerabilities
- Advance Product Search3 vulnerabilities
- Vayu Blocks – Website Builder For The Block Editor3 vulnerabilities
- Advance Wordpress Search Plugin2 vulnerabilities
- Big Store2 vulnerabilities
- Easy Mega Menu For Wordpress – Themehunk2 vulnerabilities
- Gutenberg Blocks2 vulnerabilities
- Hunk Companion2 vulnerabilities
- Mega Menu2 vulnerabilities
- Th Shop Mania2 vulnerabilities
- Vayu Blocks – Gutenberg Blocks For Wordpress & Woocommerce2 vulnerabilities
- Advance Product Search Voice & Ajax Search For Woocommerce1 vulnerabilities
- Oneline Lite1 vulnerabilities
- Open Shop1 vulnerabilities
- Th Advance Product Search1 vulnerabilities
- TH Login Registration1 vulnerabilities
- TH Variation Swatches1 vulnerabilities
- Themehunk1 vulnerabilities
- Themehunk Customizer1 vulnerabilities
- Top Store1 vulnerabilities
- Variation Swatches1 vulnerabilities
- Variation Swatches For Woocommerce1 vulnerabilities
- Vayu Blocks1 vulnerabilities
- Wishlist For Woocommerce1 vulnerabilities
- WP Popup Builder – Popup Forms And Marketing Lead Generation1 vulnerabilities
- Zita1 vulnerabilities
- Zita Site Builder1 vulnerabilities
HighCVE-2026-111838themehunk · themehunk customizerWordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7.EPSS0.20%HighCVE-2021-24967themehunk · contact_form_\&_lead_form_elementor_builder +2 moreContact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site ScriptingThe Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted LeadsEPSS1.19%MediumCVE-2025-2568themehunk · vayu blocks – gutenberg blocks for wordpress & woocommerce +1 moreVayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options UpdateThe Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the 'vayu_blocks_get_toggle_switch_values_callback' and 'vayu_blocks_save_toggle_switch_callback' function in versions 1.0.4 to 1.2.1. This makes it possible for unauthenticated attackers to read plugin options and update any option with a key name ending in '_value'.EPSS0.38%CriticalCVE-2025-52816themehunk · zita +1 moreWordPress Zita theme <= 1.6.5 - Local File Inclusion VulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehunk Zita zita allows PHP Local File Inclusion.This issue affects Zita: from n/a through <= 1.6.5.EPSS0.52%MediumCVE-2025-62902themehunk · wp_popup_builder +1 moreWordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerabilityExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedded Sensitive Data.This issue affects WP Popup Builder: from n/a through <= 1.3.8.EPSS0.31%MediumCVE-2025-68046themehunk · contact_form_\&_lead_form_elementor_builder +1 moreWordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerabilityExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.EPSS0.42%MediumCVE-2025-9378themehunk · vayu blocks – website builder for the block editor +1 moreVayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block AttributesThe Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie block in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.24%MediumCVE-2025-4420themehunk · vayu blocks – website builder for the block editor +1 moreVayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth ParameterThe Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerWidth’ parameter in all versions up to, and including, 1.3.1 due to a missing capability check on the vayu_blocks_option_panel_callback() function and insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.29%MediumCVE-2025-22644themehunk · vayu_blocks +2 moreWordPress Vayu Blocks – Gutenberg Blocks plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce vayu-blocks allows Stored XSS.This issue affects Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: from n/a through <= 1.4.7.EPSS0.26%MediumCVE-2025-69344themehunk · oneline lite +1 moreWordPress Oneline Lite theme <= 6.6 - Broken Access Control vulnerabilityMissing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oneline Lite: from n/a through <= 6.6.EPSS0.18%MediumCVE-2025-30990themehunk · mega_menu +2 moreWordPress ThemeHunk plugin <= 1.2.0 - Broken Access Control vulnerabilityMissing Authorization vulnerability in ThemeHunk ThemeHunk themehunk-megamenu-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeHunk: from n/a through <= 1.2.0.EPSS0.25%MediumCVE-2025-30881themehunk · big_store +1 moreWordPress Big Store theme <= 2.0.8 - Broken Access Control vulnerabilityMissing Authorization vulnerability in themehunk Big Store big-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Big Store: from n/a through <= 2.0.8.EPSS0.36%MediumCVE-2025-12040themehunk · wishlist for woocommerce +1 moreWishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist ManipulationThe Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.3 via several functions in class-th-wishlist-frontend.php due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to modify other user's wishlistsEPSS0.24%CriticalCVE-2022-40218themehunk · advance_product_search +2 moreWordPress TH Advance Product Search plugin <= 1.1.4 - Unauthenticated Plugin Settings Change vulnerabilityMissing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.1.4.EPSS0.49%MediumCVE-2022-2404themehunk · wp_popup_builder +2 moreWP Popup Builder < 1.2.9 - Reflected Cross-Site ScriptingThe WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site ScriptingEPSS0.63%HighCVE-2022-2405themehunk · wp_popup_builder +2 moreWP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup DeletionThe WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary PopupEPSS0.32%CriticalCVE-2022-38057themehunk · advance wordpress search plugin +2 moreWordPress TH Advance Product Search plugin <= 1.2.1 - Unauthenticated Plugin Settings Reset vulnerabilityMissing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1.EPSS0.60%MediumCVE-2022-23179themehunk · contact_form_\&_lead_form_elementor_builder +2 moreContact Form & Lead Form Elementor Builder < 1.7.0 - Multiple Admin+ Stored Cross-Site ScriptingThe Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowedEPSS0.54%MediumCVE-2022-23180themehunk · contact_form_\&_lead_form_elementor_builder +2 moreContact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings UpdateThe Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settingsEPSS0.53%CriticalCVE-2024-54369themehunk · zita site builder +1 moreWordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerabilityMissing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through <= 1.0.2.EPSS1.63%