HashThemes vulnerabilities

Products

• Hash Form 8
• Easy Elementor Addons 7
• Hash Elements 5
• Hash Form – Drag & Drop Form Builder 4
• Total 3
• HashThemes Demo Importer 2
• Smart Blocks 2
• drag and drop form builder 1
• Easy Elementor Addons – Addons Pack for Elementor Page Builder 1
• HashOne 1
• Mini Ajax Cart for WooCommerce 1
• Square 1
• Viral 1
• Viral Mag 1
• Viral News 1

Latest HashThemes CVEs

Newest publication first · page 1 of 2

1. CVE-2026-81780 WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability

   Published 2026-08-31

   Critical·CVSS 10.0 EPSS 0.52%

   Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.

2. CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability

   Published 2026-08-27

   Critical·CVSS 9.8 EPSS 0.56%

   Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.

3. CVE-2026-78280 WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2026-08-24

   Medium·CVSS 4.3 EPSS 0.14%

   Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.

4. CVE-2026-28164 WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2026-08-20

   Critical·CVSS 9.6 EPSS 0.20%

   Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.

5. CVE-2026-65483 WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

   Published 2026-07-23

   Medium·CVSS 5.9 EPSS 0.24%

   Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

6. CVE-2026-24618 WordPress Hash Elements plugin <= 1.5.4 - Sensitive Data Exposure vulnerability

   Published 2026-06-12

   Medium·CVSS 4.3 EPSS 0.18%

   Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HashThemes Hash Elements allows Retrieve Embedded Sensitive Data. This issue affects Hash Elements: from n/a through 1.5.4.

7. CVE-2026-5077 Total <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute

   Published 2026-05-02

   Medium·CVSS 5.4 EPSS 0.19%

   The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output escaping when rendering the_title() inside HTML attribute context in the home blog section template. This makes it possibl...

8. CVE-2026-6370 WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

   Published 2026-04-15

   Medium·CVSS 5.9 EPSS 0.14%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4.

9. CVE-2025-9045 Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

   Published 2025-10-03

   Medium·CVSS 6.4 EPSS 0.35%

   The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

10. CVE-2025-58973 WordPress Easy Elementor Addons Plugin <= 2.2.8 - Local File Inclusion Vulnerability

    Published 2025-09-22

    High·CVSS 7.5 EPSS 0.61%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows PHP Local File Inclusion.This issue affects Easy Elementor Addons: from n/a through <= 2.2.8.

11. CVE-2025-59561 WordPress Smart Blocks Plugin <= 2.4 - Broken Access Control Vulnerability

    Published 2025-09-22

    Medium·CVSS 4.3 EPSS 0.25%

    Missing Authorization vulnerability in hashthemes Smart Blocks smart-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Blocks: from n/a through <= 2.4.

12. CVE-2025-54712 WordPress Easy Elementor Addons Plugin <= 2.2.7 - Broken Access Control Vulnerability

    Published 2025-08-14

    Medium·CVSS 4.3 EPSS 0.22%

    Missing Authorization vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Elementor Addons: from n/a through <= 2.2.7.

13. CVE-2025-54704 WordPress Easy Elementor Addons plugin <= 2.2.6 - Cross Site Scripting (XSS) Vulnerability

    Published 2025-08-14

    Medium·CVSS 6.5 EPSS 0.20%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows DOM-Based XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.2.6.

14. CVE-2025-48295 WordPress Easy Elementor Addons plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability

    Published 2025-07-16

    Medium·CVSS 6.5 EPSS 0.25%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.2.5.

15. CVE-2025-47468 WordPress Hash Form plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerability

    Published 2025-05-07

    Medium·CVSS 4.3 EPSS 0.17%

    Cross-Site Request Forgery (CSRF) vulnerability in hashthemes Hash Form hash-form allows Cross Site Request Forgery.This issue affects Hash Form: from n/a through <= 1.2.8.

16. CVE-2025-26912 WordPress Easy Elementor Addons plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

    Published 2025-02-25

    Medium·CVSS 6.5 EPSS 0.26%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.6.

17. CVE-2025-26761 WordPress Easy Elementor Addons plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

    Published 2025-02-16

    Medium·CVSS 6.5 EPSS 0.23%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows DOM-Based XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.5.

18. CVE-2025-22296 WordPress Hash Elements plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

    Published 2025-01-07

    Medium·CVSS 6.5 EPSS 0.26%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Hash Elements hash-elements.This issue affects Hash Elements: from n/a through <= 1.5.0.

19. CVE-2023-28990 WordPress Viral Mag theme <= 1.0.9 - Authenticated Arbitrary Plugin Activation Vulnerability

    Published 2024-12-13

    Medium·CVSS 4.3 EPSS 0.47%

    Missing Authorization vulnerability in HashThemes Viral Mag allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Mag: from n/a through 1.0.9.

20. CVE-2023-27456 WordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin Activation

    Published 2024-12-13

    Medium·CVSS 4.3 EPSS 0.47%

    Missing Authorization vulnerability in HashThemes Total allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total: from n/a through 2.1.19.

21. CVE-2024-12201 Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation

    Published 2024-12-12

    Medium·CVSS 4.3 EPSS 0.38%

    The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level a...

22. CVE-2023-30486 WordPress Square theme <= 2.0.0 - Broken Access Control

    Published 2024-12-09

    Medium·CVSS 4.3 EPSS 0.75%

    Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: from n/a through 2.0.0.

23. CVE-2024-10802 Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure

    Published 2024-11-13

    Medium·CVSS 5.3 EPSS 0.63%

    The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_id() function in all versions up to, and including, 1.4.7. This makes it possible for unauthenticated attackers to retriev...

24. CVE-2024-49270 WordPress Smart Blocks plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

    Published 2024-10-16

    Medium·CVSS 6.5 EPSS 0.27%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Smart Blocks smart-blocks allows Stored XSS.This issue affects Smart Blocks: from n/a through <= 2.0.

25. CVE-2024-9417 Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload

    Published 2024-10-05

    Medium·CVSS 6.1 EPSS 0.37%

    The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to uplo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.