Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

12 records

Vendor: spicethemes Clear all filters
TI-2024-12404 CVE-2024-13362 · GHSA-c7cj-88jr-mhx2

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

Priority LOW 27

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00276 Published 2026-05-01 No fix listed CWE-79
TI-2025-30500 CVE-2025-48130 · GHSA-2v6g-667x-w6wm

WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability

Priority LOW 39

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through <= 2.0.7.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00523 Published 2025-06-09 No fix listed CWE-22
TI-2025-01117 CVE-2025-1304 · GHSA-cc29-mj6j-7rfp

NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload

Priority MEDIUM 42

The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01161 Published 2025-05-01 No fix listed CWE-862
TI-2025-26274 CVE-2025-39532 · GHSA-pg7m-r4cf-qf65

WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability

Priority LOW 39

Missing Authorization vulnerability in spicethemes Spice Blocks spice-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spice Blocks: from n/a through <= 2.0.7.7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00389 Published 2025-04-17 No fix listed CWE-862
TI-2025-01120 CVE-2025-1307 · GHSA-q4hv-4jcg-pqg9

Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload

Priority MEDIUM 53

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02158 Published 2025-03-04 No fix listed CWE-862
TI-2024-07815 CVE-2024-8430 · GHSA-jm63-gfmj-678f

Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import

Priority LOW 30

The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_importer_creater function in all versions up to, and including,…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00326 Published 2024-10-01 No fix listed CWE-862
TI-2023-04934 CVE-2023-5362 · GHSA-hwmg-864w-89m6

Cross-site scripting in spicethemes Carousel, Recent Post Slider and Banner Slider

Priority LOW 29

The Carousel, Recent Post Slider and Banner Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'spice_post_slider' shortcode in versions up to, and including, 2.0 due to insufficient input sanit…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00599 Published 2023-10-30 No fix listed CWE-79