https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-68533.htmlhttps://patchthecve.com/cve/CVE-2025-68533.htmlWed, 07 Oct 2026 13:10:00 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WC Builder wc-builder allows Stored XSS.This issue affects WC Builder: from n/a through <= 1.2.0.https://patchthecve.com/cve/CVE-2025-64271.htmlhttps://patchthecve.com/cve/CVE-2025-64271.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 4.3: Cross-Site Request Forgery (CSRF) vulnerability in HasThemes WP Plugin Manager wp-plugin-manager allows Cross Site Request Forgery.This issue affects WP Plugin Manager: from n/a through <= 1.4.7.https://patchthecve.com/cve/CVE-2025-12493.htmlhttps://patchthecve.com/cve/CVE-2025-12493.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated athttps://patchthecve.com/cve/CVE-2025-11823.htmlhttps://patchthecve.com/cve/CVE-2025-11823.htmlThu, 08 Oct 2026 11:10:00 +0000MEDIUM 6.4: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode in all versions up to, and including, 3.2.4 due to insufficienthttps://patchthecve.com/cve/CVE-2025-58990.htmlhttps://patchthecve.com/cve/CVE-2025-58990.htmlWed, 17 Jun 2026 09:45:23 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Stored XSS.This issue affects ShopLentor: from n/a through <= 3.2.0.https://patchthecve.com/cve/CVE-2025-8401.htmlhttps://patchthecve.com/cve/CVE-2025-8401.htmlWed, 17 Jun 2026 10:06:53 +0000MEDIUM 4.3: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.1 via the 'get_post_data' function. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive https://patchthecve.com/cve/CVE-2025-8151.htmlhttps://patchthecve.com/cve/CVE-2025-8151.htmlWed, 17 Jun 2026 10:06:24 +0000MEDIUM 4.3: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'save_block_css' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any directoryhttps://patchthecve.com/cve/CVE-2025-8068.htmlhttps://patchthecve.com/cve/CVE-2025-8068.htmlWed, 17 Jun 2026 10:06:15 +0000MEDIUM 4.3: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an improper capability check on the 'ajax_trash_templates' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, withttps://patchthecve.com/cve/CVE-2025-7360.htmlhttps://patchthecve.com/cve/CVE-2025-7360.htmlWed, 17 Jun 2026 10:04:46 +0000CRITICAL 9.1: The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handle_files_upload() function in all versions up to, and including, 2.2.1. This makes it possible for uhttps://patchthecve.com/cve/CVE-2025-7341.htmlhttps://patchthecve.com/cve/CVE-2025-7341.htmlWed, 17 Jun 2026 10:04:45 +0000CRITICAL 9.1: The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the temp_file_delete() function in all versions up to, and including, 2.2.1. This makes it possible for unhttps://patchthecve.com/cve/CVE-2025-7340.htmlhttps://patchthecve.com/cve/CVE-2025-7340.htmlWed, 17 Jun 2026 10:04:45 +0000CRITICAL 9.8: The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the temp_file_upload() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenhttps://patchthecve.com/cve/CVE-2025-3775.htmlhttps://patchthecve.com/cve/CVE-2025-3775.htmlWed, 17 Jun 2026 09:20:38 +0000MEDIUM 6.5: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unhttps://patchthecve.com/cve/CVE-2025-1802.htmlhttps://patchthecve.com/cve/CVE-2025-1802.htmlWed, 17 Jun 2026 08:39:48 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘marker_title’, 'notification_content', and 'stt_button_text' parameters in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping. This https://patchthecve.com/cve/CVE-2025-1527.htmlhttps://patchthecve.com/cve/CVE-2025-1527.htmlWed, 17 Jun 2026 08:39:18 +0000MEDIUM 6.4: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to a Stored DOM-Based Cross-Site Scripting via the plugin's Flash Sale Countdown module in all versions up to, and including, 3.1.0 due to insuffichttps://patchthecve.com/cve/CVE-2025-1261.htmlhttps://patchthecve.com/cve/CVE-2025-1261.htmlWed, 17 Jun 2026 08:38:41 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it https://patchthecve.com/cve/CVE-2025-26917.htmlhttps://patchthecve.com/cve/CVE-2025-26917.htmlWed, 17 Jun 2026 09:02:36 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WP Templata wptemplata allows Reflected XSS.This issue affects WP Templata: from n/a through <= 1.0.7.https://patchthecve.com/cve/CVE-2024-12599.htmlhttps://patchthecve.com/cve/CVE-2024-12599.htmlWed, 17 Jun 2026 07:00:01 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fhttps://patchthecve.com/cve/CVE-2025-24695.htmlhttps://patchthecve.com/cve/CVE-2025-24695.htmlWed, 17 Jun 2026 08:59:27 +0000MEDIUM 4.4: Server-Side Request Forgery (SSRF) vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Server Side Request Forgery.This issue affects Extensions For CF7: from n/a through <= 3.2.0.https://patchthecve.com/cve/CVE-2024-51673.htmlhttps://patchthecve.com/cve/CVE-2024-51673.htmlWed, 17 Jun 2026 08:06:07 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems HT Politic wp-politic allows DOM-Based XSS.This issue affects HT Politic: from n/a through <= 2.4.4.https://patchthecve.com/cve/CVE-2024-51682.htmlhttps://patchthecve.com/cve/CVE-2024-51682.htmlWed, 17 Jun 2026 08:06:08 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Builder – WordPress Theme Builder for Elementor ht-builder allows Stored XSS.This issue affects HT Builder – WordPress Theme Builder for Elementor: from n/a through <= 1.3.0.https://patchthecve.com/cve/CVE-2024-49630.htmlhttps://patchthecve.com/cve/CVE-2024-49630.htmlWed, 17 Jun 2026 08:00:11 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems WP Education wp-education allows Stored XSS.This issue affects WP Education: from n/a through <= 1.2.8.https://patchthecve.com/cve/CVE-2024-9538.htmlhttps://patchthecve.com/cve/CVE-2024-9538.htmlWed, 17 Jun 2026 08:24:46 +0000MEDIUM 4.3: The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'render' function in includes/addons/wl_faq.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive phttps://patchthecve.com/cve/CVE-2024-8910.htmlhttps://patchthecve.com/cve/CVE-2024-8910.htmlWed, 17 Jun 2026 08:23:32 +0000MEDIUM 4.3: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.5 via the render function in includes/widgets/htmega_accordion.php. This makes it possible for authenticated attackers, with Contributor-level achttps://patchthecve.com/cve/CVE-2024-8668.htmlhttps://patchthecve.com/cve/CVE-2024-8668.htmlWed, 17 Jun 2026 08:23:04 +0000MEDIUM 6.4: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tooltip and countdown functionality in all versions up to, and including, 2.9.7 due to insufficient input sahttps://patchthecve.com/cve/CVE-2024-38706.htmlhttps://patchthecve.com/cve/CVE-2024-38706.htmlWed, 17 Jun 2026 07:40:54 +0000MEDIUM 6.5: Path Traversal: '.../...//' vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.5.7.https://patchthecve.com/cve/CVE-2024-5215.htmlhttps://patchthecve.com/cve/CVE-2024-5215.htmlWed, 17 Jun 2026 08:15:25 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticahttps://patchthecve.com/cve/CVE-2024-5173.htmlhttps://patchthecve.com/cve/CVE-2024-5173.htmlWed, 17 Jun 2026 08:15:20 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget settings in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possiblhttps://patchthecve.com/cve/CVE-2024-5530.htmlhttps://patchthecve.com/cve/CVE-2024-5530.htmlWed, 17 Jun 2026 08:16:08 +0000MEDIUM 6.4: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's WL: Product Horizontal Filter widget in all versions up to, and including, 2.9.0 due to insufficienhttps://patchthecve.com/cve/CVE-2024-35699.htmlhttps://patchthecve.com/cve/CVE-2024-35699.htmlWed, 17 Jun 2026 07:35:12 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes HT Feed allows Stored XSS.This issue affects HT Feed: from n/a through 1.2.8.https://patchthecve.com/cve/CVE-2024-34767.htmlhttps://patchthecve.com/cve/CVE-2024-34767.htmlWed, 17 Jun 2026 07:34:01 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes ShopLentor allows Stored XSS.This issue affects ShopLentor: from n/a through 2.8.7.https://patchthecve.com/cve/CVE-2024-4876.htmlhttps://patchthecve.com/cve/CVE-2024-4876.htmlWed, 17 Jun 2026 08:03:05 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popover_header_text’ parameter in versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackershttps://patchthecve.com/cve/CVE-2024-4875.htmlhttps://patchthecve.com/cve/CVE-2024-4875.htmlWed, 17 Jun 2026 08:03:05 +0000MEDIUM 4.3: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'ajax_dismiss' function in versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with subscribhttps://patchthecve.com/cve/CVE-2024-4566.htmlhttps://patchthecve.com/cve/CVE-2024-4566.htmlWed, 17 Jun 2026 08:02:10 +0000HIGH 7.1: The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 2.8.8. This makes it possible for authenticated attackers, with contributor-level access and above, to set arbithttps://patchthecve.com/cve/CVE-2024-3345.htmlhttps://patchthecve.com/cve/CVE-2024-3345.htmlWed, 17 Jun 2026 07:43:48 +0000MEDIUM 6.4: The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woolentorsearch shortcode in all versions up to, and including, 2.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated atthttps://patchthecve.com/cve/CVE-2023-37999.htmlhttps://patchthecve.com/cve/CVE-2023-37999.htmlWed, 17 Jun 2026 06:09:05 +0000CRITICAL 9.8: Improper Privilege Management vulnerability in HasThemes HT Mega allows Privilege Escalation.This issue affects HT Mega: from n/a through 2.2.0.https://patchthecve.com/cve/CVE-2024-3990.htmlhttps://patchthecve.com/cve/CVE-2024-3990.htmlWed, 17 Jun 2026 07:45:36 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tooltip & Popover Widget in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fohttps://patchthecve.com/cve/CVE-2024-3989.htmlhttps://patchthecve.com/cve/CVE-2024-3989.htmlWed, 17 Jun 2026 07:45:36 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gallery Justify Widget in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it posshttps://patchthecve.com/cve/CVE-2023-6327.htmlhttps://patchthecve.com/cve/CVE-2023-6327.htmlWed, 17 Jun 2026 06:50:32 +0000MEDIUM 5.3: The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the purchased_new_products function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to view all products purchahttps://patchthecve.com/cve/CVE-2024-3991.htmlhttps://patchthecve.com/cve/CVE-2024-3991.htmlWed, 17 Jun 2026 07:45:37 +0000MEDIUM 6.4: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute in the Horizontal Product Filter in all versions up to, and including, 2.8.7 due to insufficiehttps://patchthecve.com/cve/CVE-2024-3308.htmlhttps://patchthecve.com/cve/CVE-2024-3308.htmlWed, 17 Jun 2026 07:43:45 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget's attributes in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackhttps://patchthecve.com/cve/CVE-2024-3307.htmlhttps://patchthecve.com/cve/CVE-2024-3307.htmlWed, 17 Jun 2026 07:43:45 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget's attributes in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackehttps://patchthecve.com/cve/CVE-2024-2790.htmlhttps://patchthecve.com/cve/CVE-2024-2790.htmlWed, 17 Jun 2026 07:25:33 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Accordion widget in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticahttps://patchthecve.com/cve/CVE-2024-2085.htmlhttps://patchthecve.com/cve/CVE-2024-2085.htmlWed, 17 Jun 2026 07:23:42 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' value in several widgets all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possiblhttps://patchthecve.com/cve/CVE-2024-2084.htmlhttps://patchthecve.com/cve/CVE-2024-2084.htmlWed, 17 Jun 2026 07:23:42 +0000MEDIUM 6.4: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox widget in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fohttps://patchthecve.com/cve/CVE-2023-7067.htmlhttps://patchthecve.com/cve/CVE-2023-7067.htmlWed, 17 Jun 2026 06:51:59 +0000MEDIUM 4.3: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woolentor_template_store' function in all versions up to, and includhttps://patchthecve.com/cve/CVE-2023-6214.htmlhttps://patchthecve.com/cve/CVE-2023-6214.htmlWed, 17 Jun 2026 06:50:18 +0000HIGH 7.5: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.6 via the purchased_products function. This makes it possible for unauthenticatied attackers to extract sensitive data including the previous 7 dhttps://patchthecve.com/cve/CVE-2024-32782.htmlhttps://patchthecve.com/cve/CVE-2024-32782.htmlWed, 17 Jun 2026 07:30:25 +0000MEDIUM 4.3: Insertion of Sensitive Information Into Sent Data vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.4.7.https://patchthecve.com/cve/CVE-2024-1057.htmlhttps://patchthecve.com/cve/CVE-2024-1057.htmlWed, 17 Jun 2026 07:03:20 +0000MEDIUM 6.4: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishsuite_button' shortcode in all versions up to, and including, 2.8.1 due to insufficient input https://patchthecve.com/cve/CVE-2024-2946.htmlhttps://patchthecve.com/cve/CVE-2024-2946.htmlWed, 17 Jun 2026 07:25:53 +0000MEDIUM 6.4: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's QR Code Widget in all versions up to, and including, 2.8.4 due to insufficient input sanitization ahttps://patchthecve.com/cve/CVE-2024-1974.htmlhttps://patchthecve.com/cve/CVE-2024-1974.htmlWed, 17 Jun 2026 07:05:31 +0000HIGH 8.8: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.6 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to read the contents of arbitrary files on