Vulnerabilidades en ThemeHunk

36 resultados
Análisis Vexday

ThemeHunk apresenta um perfil de risco moderado com 14 vulnerabilidades catalogadas, sendo 2 críticas, porém nenhuma em exploração ativa registrada no KEV até o momento. A fraqueza predominante é autorização inadequada (CWE-862), padrão comum em plugins/temas WordPress, com 2 novas descobertas nos últimos 90 dias indicando exposição contínua a falhas de controle de acesso.

CVE-2024-44049MEDIUMWordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Authenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-4420MEDIUMVayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth ParameterEPSS 0.2%CVE-2026-1454HIGHResponsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-22644MEDIUMWordPress Vayu Blocks – Gutenberg Blocks plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-12040MEDIUMWishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist ManipulationEPSS 0.2%CVE-2025-9378MEDIUMVayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block AttributesEPSS 0.2%CVE-2026-56070CRITICALWordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-57405HIGHWordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-30990MEDIUMWordPress ThemeHunk plugin <= 1.2.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-14250MEDIUMThemehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation via 'role' ParameterEPSS 0.2%CVE-2023-28688MEDIUMWordPress TH Variation Swatches plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2024-13511MEDIUMVariation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings ResetEPSS 0.2%CVE-2023-25969MEDIUMWordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-69344MEDIUMWordPress Oneline Lite theme <= 6.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-25438HIGHWordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-32532HIGHWordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%