spicethemes vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20242
3. 20256
4. 20263

Newest CVEs

• CVE-2024-13362

  Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

  sebet · Go Fetch Jobs (for WP Job Manager)

  Medium6.1
• CVE-2026-39621

  WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability

  spicethemes · SpicePress

  High8.8
• CVE-2025-12821

  NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation

  spicethemes · NewsBlogger

  High8.8
• CVE-2025-48130

  WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability

  spicethemes · Spice Blocks

  High7.5
• CVE-2025-1304

  NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload

  spicethemes · NewsBlogger

  High8.8
• CVE-2025-1305

  NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation

  spicethemes · NewsBlogger

  High8.8
• CVE-2025-39532

  WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability

  spicethemes · Spice Blocks

  High7.5
• CVE-2025-1307

  Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload

  spicethemes · Newscrunch

  Critical9.8
• CVE-2025-1306

  Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload

  spicethemes · Newscrunch

  High8.8
• CVE-2024-8430

  Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import

  spicethemes · Spice Starter Sites

  Medium5.3