https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-62902.htmlhttps://patchthecve.com/cve/CVE-2025-62902.htmlThu, 08 Oct 2026 11:10:00 +0000MEDIUM 5.3: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedded Sensitive Data.This issue affects WP Popup Builder: from n/a through <= 1.3.8.https://patchthecve.com/cve/CVE-2025-52816.htmlhttps://patchthecve.com/cve/CVE-2025-52816.htmlWed, 17 Jun 2026 09:37:06 +0000HIGH 8.1: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehunk Zita zita allows PHP Local File Inclusion.This issue affects Zita: from n/a through <= 1.6.5.https://patchthecve.com/cve/CVE-2025-30990.htmlhttps://patchthecve.com/cve/CVE-2025-30990.htmlWed, 17 Jun 2026 09:09:41 +0000MEDIUM 4.3: Missing Authorization vulnerability in ThemeHunk ThemeHunk themehunk-megamenu-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeHunk: from n/a through <= 1.2.0.https://patchthecve.com/cve/CVE-2024-10475.htmlhttps://patchthecve.com/cve/CVE-2024-10475.htmlWed, 17 Jun 2026 06:55:45 +0000MEDIUM 4.8: The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (fohttps://patchthecve.com/cve/CVE-2025-22644.htmlhttps://patchthecve.com/cve/CVE-2025-22644.htmlWed, 17 Jun 2026 08:48:56 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce vayu-blocks allows Stored XSS.This issue affects Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: from n/a through <= https://patchthecve.com/cve/CVE-2025-30881.htmlhttps://patchthecve.com/cve/CVE-2025-30881.htmlWed, 17 Jun 2026 09:09:30 +0000MEDIUM 4.3: Missing Authorization vulnerability in themehunk Big Store big-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Big Store: from n/a through <= 2.0.8.https://patchthecve.com/cve/CVE-2024-11972.htmlhttps://patchthecve.com/cve/CVE-2024-11972.htmlWed, 17 Jun 2026 06:58:48 +0000CRITICAL 9.8: The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin behttps://patchthecve.com/cve/CVE-2023-28688.htmlhttps://patchthecve.com/cve/CVE-2023-28688.htmlWed, 17 Jun 2026 05:48:33 +0000MEDIUM 5.4: Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7.https://patchthecve.com/cve/CVE-2024-9061.htmlhttps://patchthecve.com/cve/CVE-2024-9061.htmlWed, 17 Jun 2026 08:23:52 +0000HIGH 7.3: The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action thttps://patchthecve.com/cve/CVE-2024-9707.htmlhttps://patchthecve.com/cve/CVE-2024-9707.htmlWed, 17 Jun 2026 08:25:06 +0000CRITICAL 9.8: The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to installhttps://patchthecve.com/cve/CVE-2024-8434.htmlhttps://patchthecve.com/cve/CVE-2024-8434.htmlWed, 17 Jun 2026 08:22:34 +0000MEDIUM 4.3: The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with subscriber-level https://patchthecve.com/cve/CVE-2024-44049.htmlhttps://patchthecve.com/cve/CVE-2024-44049.htmlWed, 17 Jun 2026 07:52:13 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks.This issue affects Gutenberg Blocks: from n/a through <= 1.2.8.