PatchTheCVEthemehunk vulnerabilities
Recent CVEs affecting themehunk products. 12 tracked.
themehunk has 12 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 12. Most recent: 2025-10-27. Highest priority: CVE-2024-11972 (score 72/100).
- CVE-2025-62902 MEDIUM 5.3 UPGRADE Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup
- CVE-2025-52816 HIGH 8.1 UPGRADE Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
- CVE-2025-30990 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in ThemeHunk ThemeHunk themehunk-megamenu-plus allows Exploiting Incorrect
- CVE-2025-30881 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in themehunk Big Store big-store allows Exploiting Incorrectly Configured
- CVE-2025-22644 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHun
- CVE-2024-9707 CRITICAL 9.8 UPGRADE The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a
- CVE-2024-9061 HIGH 7.3 UPGRADE The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arb
- CVE-2024-8434 MEDIUM 4.3 UPGRADE The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access
- CVE-2024-44049 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHun
- CVE-2024-11972 CRITICAL 9.8 UPGRADE The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowin
- CVE-2024-10475 MEDIUM 4.8 UPGRADE The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise a
- CVE-2023-28688 MEDIUM 5.4 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request F
FAQ
How do I fix themehunk vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is themehunk being exploited right now?
None of the tracked themehunk CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which themehunk CVE should I patch first?
CVE-2024-11972 currently ranks highest (72/100): The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowin.