Skip to content
OpenAdvisories

Vendor

spicethemes

11 known vulnerabilities.

spicethemes at a glance

Last 12 months
2
Critical · all time
1
Exploited · all time
0
Public exploit · all time
3
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 1 vulnerability March 2026: 0 vulnerabilities Mar April 2026: 1 vulnerability May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202610
Mar 202600
Feb 202610
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202510
May 202520
Apr 202510
Mar 202521
Feb 202500
Jan 202500
Dec 202400

Products

NewsBlogger 3 Newscrunch 2 Spice Starter Sites 2 Spice Blocks 2 Carousel, Recent Post Slider and Banner Slider 1 SpicePress 1
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • High 8.8
    CVE-2026-39621

    WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: from n/a through <= 2.3.2.5.

    spicethemes SpicePress
  • High 8.8
    CVE-2025-12821

    NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation

    The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.5.9. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthen…

    spicethemes NewsBlogger Web / CMS
  • High 7.5
    CVE-2025-48130

    WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through <= 2.0.7.4.

    spicethemes Spice Blocks
  • High 8.8
    CVE-2025-1305

    NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation

    The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possib…

    spicethemes NewsBlogger Web / CMS
  • High 8.8
    CVE-2025-1304 Public exploit

    NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload

    The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated att…

    spicethemes NewsBlogger Web / CMS
  • High 7.5
    CVE-2025-39532

    WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in spicethemes Spice Blocks spice-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spice Blocks: from n/a through <= 2.0.7.7.

    spicethemes Spice Blocks
  • Critical 9.8
    CVE-2025-1307 Public exploit

    Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload

    The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attac…

    spicethemes Newscrunch Web / CMS
  • High 8.8
    CVE-2025-1306 Public exploit

    Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload

    The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible f…

    spicethemes Newscrunch Web / CMS
  • Medium 5.3
    CVE-2024-8430

    Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import

    The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_importer_creater function in all versions up to, and including, 1.2.5. This makes it possible for unau…

    spicethemes Spice Starter Sites Web / CMS
  • High 7.1
    CVE-2024-44003

    WordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through <= 1.2.5.

    spicethemes Spice Starter Sites
  • Medium 6.4
    CVE-2023-5362

    Carousel, Recent Post Slider and Banner Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Carousel, Recent Post Slider and Banner Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'spice_post_slider' shortcode in versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user sup…

    spicethemes Carousel, Recent Post Slider and Banner Slider Web / CMS