Skip to content
OpenAdvisories

Vendor

spicethemes

11 known vulnerabilities.

Products

NewsBlogger 3 Newscrunch 2 Spice Starter Sites 2 Spice Blocks 2 Carousel, Recent Post Slider and Banner Slider 1 SpicePress 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2025-1307 Public exploit

    Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload

    The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attac…

    spicethemes Newscrunch Web / CMS