https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-22296.htmlhttps://patchthecve.com/cve/CVE-2025-22296.htmlWed, 17 Jun 2026 08:46:15 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Hash Elements hash-elements.This issue affects Hash Elements: from n/a through <= 1.5.0.https://patchthecve.com/cve/CVE-2024-12201.htmlhttps://patchthecve.com/cve/CVE-2024-12201.htmlWed, 17 Jun 2026 06:59:14 +0000MEDIUM 4.3: The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to https://patchthecve.com/cve/CVE-2024-10802.htmlhttps://patchthecve.com/cve/CVE-2024-10802.htmlWed, 17 Jun 2026 06:56:28 +0000MEDIUM 5.3: The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_id() function in all versions up to, and including, 1.4.7. This makes it possible for unauthenticated attackers to retrieve draft post titles https://patchthecve.com/cve/CVE-2024-9417.htmlhttps://patchthecve.com/cve/CVE-2024-9417.htmlWed, 17 Jun 2026 08:24:32 +0000MEDIUM 6.1: The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are exhttps://patchthecve.com/cve/CVE-2024-5085.htmlhttps://patchthecve.com/cve/CVE-2024-5085.htmlWed, 17 Jun 2026 08:15:09 +0000HIGH 8.1: The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input in the 'process_entry' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No knowhttps://patchthecve.com/cve/CVE-2024-5084.htmlhttps://patchthecve.com/cve/CVE-2024-5084.htmlWed, 17 Jun 2026 08:15:09 +0000CRITICAL 9.8: The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files ohttps://patchthecve.com/cve/CVE-2024-5177.htmlhttps://patchthecve.com/cve/CVE-2024-5177.htmlWed, 17 Jun 2026 08:15:21 +0000MEDIUM 6.4: The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter within multiple widgets in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentichttps://patchthecve.com/cve/CVE-2024-30426.htmlhttps://patchthecve.com/cve/CVE-2024-30426.htmlWed, 17 Jun 2026 07:26:56 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Hash Elements allows Stored XSS.This issue affects Hash Elements: from n/a through 1.3.3.