HasThemes Vulnerabilities and Affected Products
Vulnerabilities associated with WC Builder – WooCommerce Page Builder for WPBakery.
Products
Clear product- ShopLentor4 vulnerabilities
- HT Easy GA4 ( Google Analytics 4 )2 vulnerabilities
- HT Feed2 vulnerabilities
- HT Mega2 vulnerabilities
- HT Mega – Absolute Addons For Elementor2 vulnerabilities
- ht_mega_-_absolute_addons_for_elementor_page_builder2 vulnerabilities
- WC Builder2 vulnerabilities
- download_contact_form_7_widget_for_elementor_page_builder_\&_gutenberg_blocks1 vulnerability
- Extensions For CF71 vulnerability
- Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)1 vulnerability
- Free WooCommerce Theme 99fy Extension1 vulnerability
- HashBar – WordPress Notification Bar1 vulnerability
- HT Builder – WordPress Theme Builder for Elementor1 vulnerability
- HT Menu1 vulnerability
- ht_easy_ga4_\(google_analytics_4\)1 vulnerability
- ht_feed1 vulnerability
- JustTables1 vulnerability
- Really Simple Google Tag Manager1 vulnerability
- Swatchly1 vulnerability
- Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches)1 vulnerability
- WC Builder – WooCommerce Page Builder for WPBakery1 vulnerability
- woolentor-addons1 vulnerability
- WP Plugin Manager1 vulnerability
- WP Templata1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-14054MEDIUM | WC Builder <= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode AttributeThe WC Builder – WooCommerce Page Builder for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'heading_color' parameter (and multiple other styling parameters) of the `wpbforwpbakery_product_additional_information` shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary web scripts in pages t… CWE-79Dec 21, 2025 | CVSS4.4v3.1 | EPSS0.207% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |