Vulnerabilities

TI-2026-67975 CVE-2026-39778 · GHSA-m3w4-cwrm-66cg

Cross-site scripting in Ansar Import WordPress plugin

LOW 30

Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-10-06 No fix listed CWE-79

TI-2026-19826 CVE-2026-24586 · GHSA-7f6v-34pp-pxv2

WordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerability

LOW 24

Missing Authorization vulnerability in Themeansar Newses allows Exploiting Incorrectly Configured Access Control Security Levels.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00255 Published 2026-05-25 No fix listed CWE-862

TI-2025-07946 CVE-2025-8682 · GHSA-8qmq-qcpw-x7qq

Newsup <= 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation

LOW 20

The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsup_admin_info_install_plugin() function in all versions up to, and including, 5.0.10.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00255 Published 2025-10-11 No fix listed CWE-862

Vulnerabilities

Filters

Cross-site scripting in Ansar Import WordPress plugin

WordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerability

Newsup <= 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation