Themehunk Contact Form \& Lead Form Elementor Builder vulnerabilities
8 vulnerabilities
Known vulnerabilities in Themehunk Contact Form \& Lead Form Elementor Builder, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2021-24967themehunk · contact_form_\&_lead_form_elementor_builder +2 moreContact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site ScriptingThe Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted LeadsEPSS1.19%MediumCVE-2025-68046themehunk · contact_form_\&_lead_form_elementor_builder +1 moreWordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerabilityExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.EPSS0.42%MediumCVE-2022-23179themehunk · contact_form_\&_lead_form_elementor_builder +2 moreContact Form & Lead Form Elementor Builder < 1.7.0 - Multiple Admin+ Stored Cross-Site ScriptingThe Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowedEPSS0.54%MediumCVE-2022-23180themehunk · contact_form_\&_lead_form_elementor_builder +2 moreContact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings UpdateThe Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settingsEPSS0.53%MediumCVE-2024-10475themehunk · contact_form_\&_lead_form_elementor_builder +2 moreLead Form Builder < 1.9.8 - Admin+ Stored XSSThe Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).EPSS0.33%MediumCVE-2024-3637themehunk · contact_form_\&_lead_form_elementor_builder +2 moreResponsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Admin+ Stored XSSThe Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)EPSS0.47%HighCVE-2026-32532themehunk · contact_form_\&_lead_form_elementor_builder +1 moreWordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Stored XSS.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.EPSS0.26%MediumCVE-2023-25969themehunk · contact_form_\&_lead_form_elementor_builder +4 moreWordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerabilityMissing Authorization vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Contact Form & Lead Form Elementor Builder: from n/a through 1.8.4.EPSS0.18%