Skip to content
OpenAdvisories

Vendor

NooTheme

32 known vulnerabilities.

NooTheme at a glance

Last 12 months
16
Critical · all time
5
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 10 20 December 2025: 2 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 1 vulnerability March 2026: 11 vulnerabilities, 2 critical Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202610
Jun 202600
May 202600
Apr 202600
Mar 2026112
Feb 202610
Jan 202600
Dec 202520
Nov 202560
Oct 202500
Sep 202500
Aug 202541
Jul 202520
Jun 202500
May 202511
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Jobmonster 10 Jobica Core 3 CitiLights 3 Organici Library 3 Noo Timetable 2 Yogi - Health Beauty & Yoga 2 WeMusic 2 Visionary Core 2 Realty Portal 1 Realty Portal – Agent 1 Yogi 1 Jobmonster Elementor Addon 1 Job Listings 1
All Critical High Medium Low Exploited only Public exploit

32 results · Feed

  • High 7.1
    CVE-2026-57368

    WordPress Jobmonster theme <= 4.8.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.8.5.

    NooTheme Jobmonster
  • Critical 9.8
    CVE-2026-27049

    WordPress Jobica Core plugin <= 1.4.2 - Account Takeover vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobica Core: from n/a through <= 1.4.2.

    NooTheme Jobica Core
  • Critical 9.3
    CVE-2026-25340

    WordPress Jobmonster theme < 4.8.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Jobmonster noo-jobmonster allows Blind SQL Injection.This issue affects Jobmonster: from n/a through < 4.8.4.

    NooTheme Jobmonster
  • High 7.1
    CVE-2026-24979

    WordPress Jobica Core plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobica Core jobica-core allows Reflected XSS.This issue affects Jobica Core: from n/a through <= 1.4.1.

    NooTheme Jobica Core
  • High 8.8
    CVE-2026-24978

    WordPress Jobica Core plugin <= 1.4.1 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1.

    NooTheme Jobica Core
  • High 7.1
    CVE-2026-24980

    WordPress Visionary Core plugin <= 1.4.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Visionary Core noo-visionary-core allows Reflected XSS.This issue affects Visionary Core: from n/a through <= 1.4.9.

    NooTheme Visionary Core
  • High 8.5
    CVE-2026-24977

    WordPress Organici Library plugin <= 2.1.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Organici Library noo-organici-library allows Blind SQL Injection.This issue affects Organici Library: from n/a through <= 2.1.2.

    NooTheme Organici Library
  • High 8.8
    CVE-2026-24981

    WordPress Visionary Core plugin <= 1.4.9 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.

    NooTheme Visionary Core
  • High 7.1
    CVE-2026-24975

    WordPress Organici Library plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Organici Library noo-organici-library allows Reflected XSS.This issue affects Organici Library: from n/a through <= 2.1.2.

    NooTheme Organici Library
  • High 8.8
    CVE-2026-24974

    WordPress CitiLights theme <= 3.7.1 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.

    NooTheme CitiLights
  • High 7.1
    CVE-2026-24973

    WordPress CitiLights theme <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme CitiLights noo-citilights allows Reflected XSS.This issue affects CitiLights: from n/a through <= 3.7.1.

    NooTheme CitiLights
  • High 8.8
    CVE-2026-24976

    WordPress Organici Library plugin <= 2.1.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library: from n/a through <= 2.1.2.

    NooTheme Organici Library
  • Medium 5.3
    CVE-2026-25367

    WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through < 3.7.2.

    NooTheme CitiLights
  • High 7.5
    CVE-2025-67524

    WordPress Jobmonster Elementor Addon plugin <= 1.1.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NooTheme Jobmonster Elementor Addon jobmonster-addon allows PHP Local File Inclusion.This issue affects Jobmonster Elementor Addon: from n…

    NooTheme Jobmonster Elementor Addon
  • High 7.5
    CVE-2025-67522

    WordPress Jobmonster theme <= 4.8.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NooTheme Jobmonster noo-jobmonster allows PHP Local File Inclusion.This issue affects Jobmonster: from n/a through <= 4.8.2.

    NooTheme Jobmonster
  • High 8.8
    CVE-2025-11985

    Realty Portal <= 0.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

    The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'rp_save_property_settings' function in versions 0.1 to 0.4.1. This makes it possible for …

    NooTheme Realty Portal Web / CMS
  • High 7.1
    CVE-2025-54737

    WordPress Jobmonster theme <= 4.7.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.7.8.

    NooTheme Jobmonster
  • High 8.8
    CVE-2025-54719

    WordPress Yogi - Health Beauty & Yoga Theme <= 2.9.2 - Deserialization of untrusted data Vulnerability

    Deserialization of Untrusted Data vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Object Injection.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2.

    NooTheme Yogi - Health Beauty & Yoga
  • High 7.1
    CVE-2025-54718

    WordPress Yogi - Health Beauty & Yoga theme <= 2.9.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Reflected XSS.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2.

    NooTheme Yogi - Health Beauty & Yoga
  • High 8.8
    CVE-2025-53586

    WordPress WeMusic Theme <= 1.9.1 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in NooTheme WeMusic noo-wemusic allows Object Injection.This issue affects WeMusic: from n/a through <= 1.9.1.

    NooTheme WeMusic
  • High 7.1
    CVE-2025-53585

    WordPress WeMusic theme <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme WeMusic noo-wemusic allows Reflected XSS.This issue affects WeMusic: from n/a through <= 1.9.1.

    NooTheme WeMusic
  • Critical 9.8
    CVE-2025-54738

    WordPress Jobmonster Theme <= 4.7.9 - Broken Authentication Vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster noo-jobmonster allows Authentication Abuse.This issue affects Jobmonster: from n/a through <= 4.7.9.

    NooTheme Jobmonster
  • Medium 5.3
    CVE-2025-57888

    WordPress Jobmonster Theme <= 4.8.0 - Sensitive Data Exposure Vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NooTheme Jobmonster noo-jobmonster allows Retrieve Embedded Sensitive Data.This issue affects Jobmonster: from n/a through <= 4.8.0.

    NooTheme Jobmonster
  • Medium 6.5
    CVE-2025-57887

    WordPress Jobmonster Theme <= 4.8.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Stored XSS.This issue affects Jobmonster: from n/a through <= 4.8.0.

    NooTheme Jobmonster
  • High 7.1
    CVE-2025-53201

    WordPress Jobmonster theme <= 4.7.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.7.8.

    NooTheme Jobmonster
  • High 8.8
    CVE-2025-6190

    Realty Portal – Agent <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function

    The Realty Portal – Agent plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the rp_user_profile() AJAX handler in versions 0.1.0 through 0.3.9. The handler reads the client-supplied meta key and value pairs from $_…

    NooTheme Realty Portal – Agent Web / CMS
  • High 8.8
    CVE-2025-24779

    WordPress Yogi theme < 2.9.3 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in NooTheme Yogi yogi allows Object Injection.This issue affects Yogi: from n/a through < 2.9.3.

    NooTheme Yogi
  • Critical 9.8
    CVE-2025-3918

    Job Listings 0.1 - 0.1.1 - Unauthenticated Privilege Escalation via register_action Function

    The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the register_action() function in versions 0.1 to 0.1.1. The plugin’s registration handler reads the client-supplied $_POST['user_role'] and passe…

    NooTheme Job Listings Web / CMS
  • High 8.6
    CVE-2024-37928

    WordPress Jobmonster theme <= 4.7.0 - Unauthenticated Arbitrary File Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NooTheme Jobmonster allows File Manipulation.This issue affects Jobmonster: from n/a through 4.7.0.

    NooTheme Jobmonster
  • Critical 9.8
    CVE-2024-37927

    WordPress Jobmonster theme <= 4.7.5 - Unauthenticated Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in NooTheme Jobmonster noo-jobmonster allows Privilege Escalation.This issue affects Jobmonster: from n/a through <= 4.7.5.

    NooTheme Jobmonster
  • Medium 6.5
    CVE-2022-45821

    WordPress NOO Timetable Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions.

    NooTheme Noo Timetable
  • Medium 4.3
    CVE-2022-45828

    WordPress NOO Timetable Plugin <= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions.

    NooTheme Noo Timetable