Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24

Export CSV
CVE-2024-12201

Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hashthemes
Products
Hash Form
CVE-2024-1771

Total <= 2.1.59 - Missing Authorization to Authenticated (Subscriber+) Sections Update

The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sections() function in all versions up to, and including, 2.1.59. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeat sections on the homepage.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hashthemes
Products
Total
CVE-2024-10802

Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure

The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_id() function in all versions up to, and including, 1.4.7. This makes it possible for unauthenticated attackers to retrieve draft post titles that should not be accessible to unauthenticated users.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hashthemes
Products
Hash Elements
CVE-2021-39333

Hashthemes Demo Importer <= 1.1.1 Improper Access Control Allowing Content Deletion

The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of wp-content/uploads.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Hashthemes
Products
Hashthemes Demo Importer