Log in Start free

ThemeHunk

Products

ProductCVEsExploitedLatest
Lead Form Builder & Contact Form4–Mar 11, 2026
Vayu Blocks – Website Builder for the Block Editor3–Sep 3, 2025
Contact Form & Lead Form Elementor Builder3–Jun 11, 2026
Easy Mega Menu for WordPress – ThemeHunk2–Oct 8, 2024
Gutenberg Blocks2–Mar 19, 2026
Advance Product Search2–Aug 20, 2026
Advance WordPress Search Plugin2–May 8, 2024
Big Store2–Mar 27, 2025
Th Shop Mania2–Oct 9, 2026
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce2–Apr 8, 2025
Open Shop1–Jul 13, 2026
TH Login Registration1–Jul 8, 2026
Zita1–Jun 27, 2025
TH Variation Swatches1–Dec 9, 2024
ThemeHunk1–Jun 6, 2025
ThemeHunk Customizer1–Oct 21, 2026
Top Store1–Nov 9, 2024
Variation Swatches for WooCommerce1–Jan 23, 2025
Zita Site Builder1–Dec 16, 2024
Advance Product Search- Voice & Ajax Search for WooCommerce1–Jul 16, 2026
Wishlist for WooCommerce1–Nov 25, 2025
WP Popup Builder1–Oct 27, 2025
WP Popup Builder – Popup Forms and Marketing Lead Generation1–Oct 16, 2024
Hunk Companion1–Oct 11, 2024
Oneline Lite1–Jan 7, 2026

Exploited and recent CVEs

  • CVE-2026-111838 High 7.1 WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-105883 High 7.1 WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability 0.2%
  • CVE-2026-66607 High 7.1 WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-12753 High 7.5 Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter 0.5%
  • CVE-2026-57405 High 7.1 WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability 0.3%
  • CVE-2026-14250 Medium 6.3 Themehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation via 'role' Parameter 0.4%
  • CVE-2026-56070 Critical 9.3 WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability 1.4%
  • CVE-2023-25969 Medium 5.4 WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability 0.2%
  • CVE-2026-32532 High 7.1 WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-25438 High 7.1 WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-1454 High 7.2 Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting 0.3%
  • CVE-2025-68046 Medium 6.5 WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability 0.4%
  • CVE-2025-69344 Medium 4.3 WordPress Oneline Lite theme <= 6.6 - Broken Access Control vulnerability 0.2%
  • CVE-2025-12040 Medium 6.5 Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation 0.3%
  • CVE-2025-62902 Medium 5.3 WordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerability 0.3%
  • CVE-2025-9378 Medium 6.4 Vayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes 0.2%
  • CVE-2025-52816 High 8.1 WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability 0.5%
  • CVE-2025-30990 Medium 4.3 WordPress ThemeHunk plugin <= 1.2.0 - Broken Access Control vulnerability 0.3%
  • CVE-2025-4420 Medium 6.4 Vayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameter 0.3%
  • CVE-2025-2568 Medium 5.3 Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update 0.4%
  • CVE-2025-22644 Medium 6.5 WordPress Vayu Blocks – Gutenberg Blocks plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2025-30881 Medium 4.3 WordPress Big Store theme <= 2.0.8 - Broken Access Control vulnerability 0.4%
  • CVE-2024-13511 Medium 4.3 Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset 0.2%
  • CVE-2024-54369 Critical 9.1 WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability 1.6%
  • CVE-2024-10124 Critical 9.8 Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation 32.7%
  • CVE-2023-28688 Medium 5.4 WordPress TH Variation Swatches plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2024-10674 High 8.8 Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation 1.7%
  • CVE-2024-10673 High 8.8 Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation 1.2%
  • CVE-2024-9061 High 7.3 WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add 52.3%
  • CVE-2024-9707 Critical 9.8 Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation 9.1%