HasThemes vulnerabilities
We track 7 vulnerabilities in HasThemes products across 4 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2025.
Latest HasThemes vulnerabilities
- 9.8 Critical severity
ShopLentor – All-in-One WooCommerce Growth &…: Improper Limitation of a Pathname to a Restricted Directory
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This
- 9.8 Critical severity
HT Contact Form – Drag & Drop Form Builder for…: Improper Limitation of a Pathname to a Restricted Directory
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handle_files_upload() function in all versions up to, and includ
- 9.8 Critical severity
HT Contact Form – Drag & Drop Form Builder for…: Improper Privilege Management
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the temp_file_delete() function in all versions up to, and includi
- 9.8 Critical severity
HT Contact Form – Drag & Drop Form Builder for…: Unrestricted Upload of File with Dangerous Type
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the temp_file_upload() function in all versions up to, and including, 2.
- 7.1 High severity
ShopLentor – All-in-One WooCommerce Growth &…: Missing Authorization
The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 2.8.8. This makes it possible for authenticated attackers, with contribu
- 7.5 High severity
HT Mega Addons for Elementor – Elementor…: Exposure of Sensitive Information to an Unauthorized Actor
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.6 via the purchased_products function. This makes it possible for unauthenticatied attackers to extract s
- 8.8 High severity
HT Mega – Absolute Addons For Elementor: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Mega – Absolute Addons For Elementor.This issue affects HT Mega – Absolute Addons For Elementor: from n/a through 2.3.3.