HasThemes Vulnerabilities and Affected Products
Vulnerabilities associated with WC Builder.
Products
Clear product- ShopLentor4 vulnerabilities
- HT Easy GA4 ( Google Analytics 4 )2 vulnerabilities
- HT Feed2 vulnerabilities
- HT Mega2 vulnerabilities
- HT Mega – Absolute Addons For Elementor2 vulnerabilities
- ht_mega_-_absolute_addons_for_elementor_page_builder2 vulnerabilities
- WC Builder2 vulnerabilities
- download_contact_form_7_widget_for_elementor_page_builder_\&_gutenberg_blocks1 vulnerability
- Extensions For CF71 vulnerability
- Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)1 vulnerability
- Free WooCommerce Theme 99fy Extension1 vulnerability
- HashBar – WordPress Notification Bar1 vulnerability
- HT Builder – WordPress Theme Builder for Elementor1 vulnerability
- HT Menu1 vulnerability
- ht_easy_ga4_\(google_analytics_4\)1 vulnerability
- ht_feed1 vulnerability
- JustTables1 vulnerability
- Really Simple Google Tag Manager1 vulnerability
- Swatchly1 vulnerability
- Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches)1 vulnerability
- WC Builder – WooCommerce Page Builder for WPBakery1 vulnerability
- woolentor-addons1 vulnerability
- WP Plugin Manager1 vulnerability
- WP Templata1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-68533MEDIUM | WordPress WC Builder plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WC Builder wc-builder allows Stored XSS.This issue affects WC Builder: from n/a through <= 1.2.0. CWE-79Dec 24, 2025 | CVSS6.5v3.1 | EPSS0.147% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-29926MEDIUM | WordPress WC Builder plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WC Builder allows Stored XSS.This issue affects WC Builder: from n/a through 1.0.18. CWE-79Mar 27, 2024 | CVSS6.5v3.1 | EPSS0.328% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |