spicethemes

Records12All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

spicethemes records in CISA KEV

No spicethemes vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Newsblogger 2 records MEDIUM Newscrunch 2 records MEDIUM Carousel, Recent Post Slider And Banner Slider 1 record LOW Spice Starter Sites 1 record LOW

Records

2 records in Newscrunch · all components

TI-2025-01120 CVE-2025-1307 · GHSA-q4hv-4jcg-pqg9

Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 53

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02158 Published 2025-03-04 No fix listed CWE-862

TI-2025-01119 CVE-2025-1306 · GHSA-mfc8-82p4-q9xv

Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload

MEDIUM 41

The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00531 Published 2025-03-04 No fix listed CWE-352

Open these records in search →

Critical	1
High	8
Medium	3
Low	0
No CVSS	0