CVEs we hold for Hashthemes
Records whose assigning authority named Hashthemes as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-81780WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerabilityhashthemes Hash Form
CVE-2026-78292WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerabilityhashthemes Hash Form
CVE-2026-78280WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerabilityHashThemes Hash Form
CVE-2026-65483WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityHashThemes Demo Importer
CVE-2026-6370WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityHashThemes Mini Ajax Cart for WooCommerce
CVE-2026-5077Total <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt…hashthemes Total
CVE-2026-28164WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerabilityHashThemes Easy Elementor Addons
CVE-2026-24618WordPress Hash Elements plugin <= 1.5.4 - Sensitive Data Exposure vulnerabilityHashThemes Hash Elements
CVE-2025-9045Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scriptinghashthemes Easy Elementor Addons – Addons Pack for…
CVE-2025-59561WordPress Smart Blocks Plugin <= 2.4 - Broken Access Control Vulnerabilityhashthemes Smart Blocks
CVE-2025-58973WordPress Easy Elementor Addons Plugin <= 2.2.8 - Local File Inclusion Vulnerabilityhashthemes Easy Elementor Addons
CVE-2025-54712WordPress Easy Elementor Addons Plugin <= 2.2.7 - Broken Access Control Vulnerabilityhashthemes Easy Elementor Addons
CVE-2025-54704WordPress Easy Elementor Addons plugin <= 2.2.6 - Cross Site Scripting (XSS) Vulnerabilityhashthemes Easy Elementor Addons
CVE-2025-48295WordPress Easy Elementor Addons plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerabilityhashthemes Easy Elementor Addons
CVE-2025-47468WordPress Hash Form plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerabilityhashthemes Hash Form
CVE-2025-26912WordPress Easy Elementor Addons plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerabilityhashthemes Easy Elementor Addons
CVE-2025-26761WordPress Easy Elementor Addons plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerabilityhashthemes Easy Elementor Addons
CVE-2025-22296WordPress Hash Elements plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityhashthemes Hash Elements
CVE-2024-9417Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Uploadhashthemes Hash Form – Drag & Drop Form Builder
CVE-2024-5177Hash Elements <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgetshashthemes Hash Elements
CVE-2024-5085Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injectionhashthemes Hash Form – Drag & Drop Form Builder
CVE-2024-5084Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Executionhashthemes Hash Form – Drag & Drop Form Builder
CVE-2024-49270WordPress Smart Blocks plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityhashthemes Smart Blocks
CVE-2024-30426WordPress Hash Elements plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityHashThemes Hash Elements
CVE-2024-1771Total <= 2.1.59 - Missing Authorization to Authenticated (Subscriber+) Sections Updatehashthemes Total
CVE-2024-12201Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creationhashthemes Hash Form – Drag & Drop Form Builder
CVE-2024-10802Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposurehashthemes Hash Elements
CVE-2023-33923Broken Access Control leading to Arbitrary Plugin Activation in multiple HashThemes themesHashThemes HashOne
CVE-2023-28990WordPress Viral Mag theme <= 1.0.9 - Authenticated Arbitrary Plugin Activation VulnerabilityHashThemes Viral Mag
CVE-2023-27456WordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin ActivationHashThemes Total
CVE-2021-39333Hashthemes Demo Importer <= 1.1.1 Improper Access Control Allowing Content DeletionHashthemes Demo Importer
32 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.