spicethemes

Records12All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

spicethemes records in CISA KEV

No spicethemes vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Newsblogger 2 records MEDIUM Newscrunch 2 records MEDIUM Carousel, Recent Post Slider And Banner Slider 1 record LOW Spice Starter Sites 1 record LOW

Records

2 records in Newsblogger · all components

TI-2025-01117 CVE-2025-1304 · GHSA-cc29-mj6j-7rfp

NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 42

The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01161 Published 2025-05-01 No fix listed CWE-862

TI-2025-01118 CVE-2025-1305 · GHSA-3rfj-x9v3-777c

NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation

MEDIUM 40

The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00403 Published 2025-05-01 No fix listed CWE-352

Open these records in search →

Critical	1
High	8
Medium	3
Low	0
No CVSS	0