ThemeHunk vulnerabilities
We track 16 vulnerabilities in ThemeHunk products across 18 products. 16 are rated high or critical, and none are known to be exploited. The most recent was published on October 21, 2026.
Latest ThemeHunk vulnerabilities
- 7.1 High severity
ThemeHunk Customizer: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7.
- 7.1 High severity
Th Shop Mania: Missing Authorization
Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1.
- 7.5 High severity
Advance Product Search- Voice & Ajax Search…: Improper Neutralization of Special Elements used in an SQL Command
The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied paramete
- 7.1 High severity
Open Shop: Missing Authorization
Missing Authorization vulnerability in themehunk Open Shop open-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Shop: from n/a through <= 1.7.1.
- 7.1 High severity
Contact Form & Lead Form Elementor Builder: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Stored XSS.This issue affects Contact Form & Lead Form Elementor Builder: from n
- 7.1 High severity
Gutenberg Blocks: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks allows Reflected XSS.This issue affects Gutenberg Blocks: from n/a through <= 1.2.8.
- 7.2 High severity
Lead Form Builder & Contact Form: Improper Neutralization of Input During Web Page Generation
The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 via form field submissions. This is due to insufficient input sanitization in the lfb_lea
- 9.8 Critical severity
Zita: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehunk Zita zita allows PHP Local File Inclusion.This issue affects Zita: from n/a through <= 1.6.5.
- 9.1 Critical severity
Zita Site Builder: Missing Authorization
Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through <= 1.0.2.
- 9.8 Critical severity
Vayu Blocks – Website Builder for the Block…: Improper Access Control
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tp_install() function in all versions up to, and including,
- 8.8 High severity
Th Shop Mania: Missing Authorization
The Th Shop Mania theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the th_shop_mania_install_and_activate_callback() function in all versions up to, and including, 1.4.9. This makes it possibl
- 8.8 High severity
Top Store: Missing Authorization
The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the top_store_install_and_activate_callback() function in all versions up to, and including, 1.5.4. This makes it possible for au
- 9.8 Critical severity
WP Popup Builder – Popup Forms and Marketing…: Improper Control of Generation of Code
The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the softwa
- 9.8 Critical severity
Hunk Companion: Missing Authorization
The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible
- 9.8 Critical severity
Advance WordPress Search Plugin: Missing Authorization
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.1.4.
- 9.8 Critical severity
Advance WordPress Search Plugin: Missing Authorization
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1.