Skip to content
OpenAdvisories

Vendor

ThemeHunk

39 known vulnerabilities.

Products

Lead Form Builder & Contact Form 4 Vayu Blocks – Website Builder for the Block Editor 3 Contact Form & Lead Form Elementor Builder 3 Gutenberg Blocks 2 Advance WordPress Search Plugin 2 Advance Product Search 2 Easy Mega Menu for WordPress – ThemeHunk 2 Big Store 2 Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 2 Th Shop Mania 2 Hunk Companion 1 Wishlist for WooCommerce 1 Zita 1 Variation Swatches for WooCommerce 1 Oneline Lite 1 WP Popup Builder 1 Top Store 1 ThemeHunk 1 TH Login Registration 1 Advance Product Search- Voice & Ajax Search for WooCommerce 1 TH Variation Swatches 1 ThemeHunk Customizer 1 Zita Site Builder 1 Open Shop 1 WP Popup Builder – Popup Forms and Marketing Lead Generation 1
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 7.1
    CVE-2026-111838

    WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7.

    ThemeHunk ThemeHunk Customizer
  • High 7.1
    CVE-2026-105883

    WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1.

    ThemeHunk Th Shop Mania
  • High 7.1
    CVE-2026-66607

    WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.

    ThemeHunk Advance Product Search
  • High 7.5
    CVE-2026-12753

    Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter

    The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied paramet…

    ThemeHunk Advance Product Search- Voice & Ajax Search for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-57405

    WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themehunk Open Shop open-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Shop: from n/a through <= 1.7.1.

    ThemeHunk Open Shop
  • High 7.1
    CVE-2026-32532

    WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Stored XSS.This issue affects Contact Form & Lead Form Elementor Builder: from …

    ThemeHunk Contact Form & Lead Form Elementor Builder
  • High 7.1
    CVE-2026-25438

    WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks allows Reflected XSS.This issue affects Gutenberg Blocks: from n/a through <= 1.2.8.

    ThemeHunk Gutenberg Blocks
  • High 7.2
    CVE-2026-1454

    Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting

    The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 via form field submissions. This is due to insufficient input sanitization in the lfb_le…

    ThemeHunk Lead Form Builder & Contact Form Web / CMS
  • High 8.1
    CVE-2025-52816

    WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehunk Zita zita allows PHP Local File Inclusion.This issue affects Zita: from n/a through <= 1.6.5.

    ThemeHunk Zita
  • High 8.8
    CVE-2024-10674 Public exploit

    Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

    The Th Shop Mania theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the th_shop_mania_install_and_activate_callback() function in all versions up to, and including, 1.4.9. This makes it possib…

    ThemeHunk Th Shop Mania Web / CMS
  • High 8.8
    CVE-2024-10673 Public exploit

    Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

    The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the top_store_install_and_activate_callback() function in all versions up to, and including, 1.5.4. This makes it possible for a…

    ThemeHunk Top Store Web / CMS
  • High 7.3
    CVE-2024-9061 Public exploit EPSS 54%

    WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add

    The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the softw…

    ThemeHunk WP Popup Builder – Popup Forms and Marketing Lead Generation Web / CMS