Hashthemes vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Hashthemes products: 7 record(s), with severity, exploitation and fixes.

Hash Elements 1 Easy Elementor Addons – Addons Pack for Elementor Page Builder 1 Mini Ajax Cart for WooCommerce 1 Total 1 Hash Form 1 Easy Elementor Addons 1 Smart Blocks 1

Exploited only (KEV) →

CVE-2026-78280 Medium · 4.3 CWE-352 Aug 24, 2026

WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.

CVE-2026-24618 Medium · 4.3 CWE-497 Jun 12, 2026

WordPress Hash Elements plugin <= 1.5.4 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HashThemes Hash Elements allows Retrieve Embedded Sensitive Data. This issue affects Hash Elements: from n/a through 1.5.4.

CVE-2026-5077 Medium · 5.4 CWE-79 May 2, 2026

Total <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute

The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output escaping when rendering the_title() inside HTML attribute context in the home blog section template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the malicious post to be published and displayed with a featured image in the Home Page blog section.

CVE-2026-6370 Medium · 5.9 CWE-79 Apr 15, 2026

WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4.

CVE-2025-9045 Medium · 6.4 CWE-79 Oct 3, 2025

Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2025-59561 Medium · 4.3 CWE-862 Sep 22, 2025

WordPress Smart Blocks Plugin <= 2.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in hashthemes Smart Blocks smart-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Blocks: from n/a through <= 2.4.

CVE-2025-58973 High · 7.5 CWE-98 Sep 22, 2025

WordPress Easy Elementor Addons Plugin <= 2.2.8 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows PHP Local File Inclusion.This issue affects Easy Elementor Addons: from n/a through <= 2.2.8.