Skip to content
Spicethemes vulnerabilities
Newest
-
100plugins open user map, 5starplugins dynamic copyright year, easy age verify +128 more +130 more
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
CVE-2024-13362
6.1 Medium
-
spicethemes spicepress
WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability
CVE-2026-39621
8.8 High
-
spicethemes newsblogger
NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation
CVE-2025-12821
8.8 High
-
spicethemes spice blocks
WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability
CVE-2025-48130
7.5 High
-
spicethemes newsblogger
NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation
CVE-2025-1305
8.8 High
-
spicethemes newsblogger
NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload
CVE-2025-1304
Public exploit
8.8 High
-
spicethemes spice blocks
WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability
CVE-2025-39532
7.5 High
-
spicethemes newscrunch
Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload
CVE-2025-1307
Public exploit
9.8 Critical
-
spicethemes newscrunch
Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload
CVE-2025-1306
Public exploit
8.8 High
-
spicethemes spice starter sites
Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import
CVE-2024-8430
5.3 Medium
-
spicethemes spice starter sites
WordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability
CVE-2024-44003
7.1 High
-
spicethemes carousel, recent post slider and banner slider, carousel\, recent post slider and banner slider +1 more
Carousel, Recent Post Slider and Banner Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
CVE-2023-5362
6.4 Medium