ThemeHunk vulnerabilities

🔔 Create alert RSS

Published CVEs affecting ThemeHunk products: 10 record(s), with severity, exploitation and fixes.

Contact Form & Lead Form Elementor Builder 3 Wp Popup Builder 1 Lead Form Builder & Contact Form 1 Wishlist for WooCommerce 1 Gutenberg Blocks 1 Advance Product Search 1 Th Shop Mania 1 Oneline Lite 1

Exploited only (KEV) →

CVE-2026-105883 High · 7.1 CWE-862 Oct 9, 2026

WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1.

CVE-2026-56070 Critical · 9.3 CWE-89 Jun 26, 2026

Advance Product Search - Unauthenticated SQL Injection

Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.

CVE-2023-25969 Medium · 5.4 CWE-862 Jun 11, 2026

WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Contact Form & Lead Form Elementor Builder: from n/a through 1.8.4.

CVE-2026-32532 High · 7.1 CWE-79 Mar 25, 2026

WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Stored XSS.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.

CVE-2026-25438 High · 7.1 CWE-79 Mar 19, 2026

WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks allows Reflected XSS.This issue affects Gutenberg Blocks: from n/a through <= 1.2.8.

CVE-2026-1454 High · 7.2 CWE-79 Mar 11, 2026

Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting

The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 via form field submissions. This is due to insufficient input sanitization in the lfb_lead_sanitize() function which omits certain field types from its sanitization whitelist, combined with an overly permissive wp_kses() filter at output time that allows onclick attributes on anchor tags. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the lead entries in the WordPress dashboard.

CVE-2025-68046 Medium · 6.5 CWE-497 Jan 22, 2026

WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.

CVE-2025-69344 Medium · 4.3 CWE-862 Jan 7, 2026

WordPress Oneline Lite theme <= 6.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oneline Lite: from n/a through <= 6.6.

CVE-2025-12040 Medium · 6.5 CWE-639 Nov 25, 2025

Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation

The Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.3 via several functions in class-th-wishlist-frontend.php due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to modify other user's wishlists

CVE-2025-62902 Medium · 5.3 CWE-497 Oct 26, 2025

WordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedded Sensitive Data.This issue affects WP Popup Builder: from n/a through <= 1.3.8.