hasthemes vulnerabilities

Recent CVEs affecting hasthemes products. 27 tracked.

hasthemes has 27 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 27. Most recent: 2025-12-24. Highest priority: CVE-2025-7340 (score 59/100).

• CVE-2025-12493 CRITICAL 9.8 UPGRADE The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly Woo
• CVE-2025-11823 MEDIUM 6.4 UPGRADE The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for Wo
• CVE-2025-64271 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in HasThemes WP Plugin Manager wp-plugin-manager allows Cross
• CVE-2025-68533 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasTheme
• CVE-2025-8401 MEDIUM 4.3 UPGRADE The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposu
• CVE-2025-8151 MEDIUM 4.3 UPGRADE The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versio
• CVE-2025-8068 MEDIUM 4.3 UPGRADE The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification an
• CVE-2025-7360 CRITICAL 9.1 UPGRADE The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress i
• CVE-2025-7341 CRITICAL 9.1 UPGRADE The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress i
• CVE-2025-7340 CRITICAL 9.8 UPGRADE The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress i
• CVE-2025-58990 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems
• CVE-2025-3775 MEDIUM 6.5 UPGRADE The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly Woo
• CVE-2025-26917 HIGH 7.1 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasTheme
• CVE-2025-24695 MEDIUM 4.4 UPGRADE Server-Side Request Forgery (SSRF) vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Se
• CVE-2025-1802 MEDIUM 6.4 UPGRADE The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2025-1527 MEDIUM 6.4 UPGRADE The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly Woo
• CVE-2025-1261 MEDIUM 6.4 UPGRADE The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site
• CVE-2024-9538 MEDIUM 4.3 UPGRADE The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and
• CVE-2024-8910 MEDIUM 4.3 UPGRADE The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposu
• CVE-2024-8668 MEDIUM 6.4 UPGRADE The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly Woo
• CVE-2024-5215 MEDIUM 6.4 UPGRADE The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-5173 MEDIUM 6.4 UPGRADE The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting
• CVE-2024-51682 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasTheme
• CVE-2024-51673 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems
• CVE-2024-49630 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems
• CVE-2024-38706 MEDIUM 6.5 UPGRADE Path Traversal: '.../...//' vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega
• CVE-2024-12599 MEDIUM 6.4 UPGRADE The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting

FAQ

How do I fix hasthemes vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is hasthemes being exploited right now?

None of the tracked hasthemes CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which hasthemes CVE should I patch first?

CVE-2025-7340 currently ranks highest (59/100): The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress i.

Products

• download contact form 7 widget for elementor page builder \& gutenberg blocks
• extensions for cf7
• ht builder
• ht mega
• ht politic
• shoplentor
• wc builder
• woolentor - woocommerce elementor addons \+ builder
• wp education
• wp plugin manager
• wp templata

RSS feed for hasthemes · ← Back to latest CVEs