Themehunk vulnerabilities, page 3
47 vulnerabilities
Known vulnerabilities in Themehunk products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 29 products.
HighCVE-2026-66607themehunk · advance_product_search +1 moreWordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.EPSS0.25%HighCVE-2026-57405themehunk · open shop +1 moreWordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerabilityMissing Authorization vulnerability in themehunk Open Shop open-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Shop: from n/a through <= 1.7.1.EPSS0.32%HighCVE-2026-32532themehunk · contact_form_\&_lead_form_elementor_builder +1 moreWordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Stored XSS.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.EPSS0.26%HighCVE-2026-12753themehunk · advance product search- voice & ajax search for woocommerce +1 moreAdvance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' ParameterThe Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.EPSS0.51%MediumCVE-2023-25969themehunk · contact_form_\&_lead_form_elementor_builder +4 moreWordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerabilityMissing Authorization vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Contact Form & Lead Form Elementor Builder: from n/a through 1.8.4.EPSS0.18%HighCVE-2023-27431themehunk · big_store +1 moreWordPress Big Store Theme <= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk Big Store theme <= 1.9.3 versions.EPSS0.31%MediumCVE-2023-28688themehunk · th variation swatches +2 moreWordPress TH Variation Swatches plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7.EPSS0.20%