HashThemes vulnerabilities and threats

Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.

CVE-2026-78292 is a critical unauthenticated PHP Object Injection vulnerability affecting Hash Form versions up to and including 1.4.1. It involves deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without authentication.

CVE-2026-78280 is a Cross-Site Request Forgery (CSRF) vulnerability affecting HashThemes Hash Form versions up to and including 1.4.0. This vulnerability allows an unauthenticated attacker to trick a user into submitting unwanted requests to the application. The issue has a medium severity rating with a CVSS score of 4.3.

CVE-2026-28164 is a critical Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons. It affects versions up to and including 2.3.7. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The CVSS score is 9.6, indicating a high severity with potential for complete compromise of confidentiality, integrity, and availability.

Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

CVE-2026-24618 is a medium severity vulnerability in HashThemes Hash Elements that allows unauthorized retrieval of embedded sensitive system information. The vulnerability is classified as CWE-497, indicating exposure of sensitive system information to an unauthorized control sphere. It affects versions up to 1.5.4. There is no confirmed patch or official remediation available at this time.

The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output escaping when rendering the_title() inside HTML attribute context in the home blog section template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the malicious post to be published and displayed with a featured image in the Home Page blog section.

CVE-2026-6370 is a stored cross-site scripting (XSS) vulnerability in the HashThemes Mini Ajax Cart plugin for WooCommerce. It affects versions up to 1.3.4 and allows improper neutralization of input during web page generation, potentially enabling an attacker with high privileges and user interaction to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 5.9. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows PHP Local File Inclusion.This issue affects Easy Elementor Addons: from n/a through <= 2.2.8.

Missing Authorization vulnerability in hashthemes Smart Blocks smart-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Blocks: from n/a through <= 2.4.

Missing Authorization vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Elementor Addons: from n/a through <= 2.2.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows DOM-Based XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.2.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.2.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows DOM-Based XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Hash Elements hash-elements.This issue affects Hash Elements: from n/a through <= 1.5.0.

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles.

The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_id() function in all versions up to, and including, 1.4.7. This makes it possible for unauthenticated attackers to retrieve draft post titles that should not be accessible to unauthenticated users.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Smart Blocks smart-blocks allows Stored XSS.This issue affects Smart Blocks: from n/a through <= 2.0.