HasThemes Vulnerabilities and Affected Products - Exploit Intel

Skip to content

Products

ShopLentor4 vulnerabilities
HT Easy GA4 ( Google Analytics 4 )2 vulnerabilities
HT Feed2 vulnerabilities
HT Mega2 vulnerabilities
HT Mega – Absolute Addons For Elementor2 vulnerabilities
ht_mega_-_absolute_addons_for_elementor_page_builder2 vulnerabilities
WC Builder2 vulnerabilities
download_contact_form_7_widget_for_elementor_page_builder_\&_gutenberg_blocks1 vulnerability
Extensions For CF71 vulnerability
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)1 vulnerability
Free WooCommerce Theme 99fy Extension1 vulnerability
HashBar – WordPress Notification Bar1 vulnerability
HT Builder – WordPress Theme Builder for Elementor1 vulnerability
HT Menu1 vulnerability
ht_easy_ga4_\(google_analytics_4\)1 vulnerability
ht_feed1 vulnerability
JustTables1 vulnerability
Really Simple Google Tag Manager1 vulnerability
Swatchly1 vulnerability
Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches)1 vulnerability
WC Builder – WooCommerce Page Builder for WPBakery1 vulnerability
woolentor-addons1 vulnerability
WP Plugin Manager1 vulnerability
WP Templata1 vulnerability

HasThemes vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2024-29094HIGH	WordPress HT Easy GA4 plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) allows Stored XSS.This issue affects HT Easy GA4 ( Google Analytics 4 ): from n/a through 1.1.7. CWE-79Mar 19, 2024	CVSS7.1v3.1	EPSS0.398%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-23802MEDIUM	WordPress HT Easy GA4 ( Google Analytics 4 ) Plugin <= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF) Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) plugin <= 1.0.6 versions. CWE-352Jun 15, 2023	CVSS4.3v3.1	EPSS0.273%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX