HashThemes vulnerabilities
We track 4 vulnerabilities in HashThemes products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 20, 2026.
Latest HashThemes vulnerabilities
- 9.6 Critical severity
Easy Elementor Addons: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.
- 7.5 High severity
Easy Elementor Addons: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows PHP Local File Inclusion.This issue affects Easy Elementor Addons: from n/a t
- 9.8 Critical severity
Hash Form – Drag & Drop Form Builder: Deserialization of Untrusted Data
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input in the 'process_entry' function. This makes it possible for unauthenticated a
- 9.8 Critical severity
Hash Form – Drag & Drop Form Builder: Unrestricted Upload of File with Dangerous Type
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticat