Skip to content
OpenAdvisories

Vendor

spicethemes

11 known vulnerabilities.

Products

NewsBlogger 3 Newscrunch 2 Spice Starter Sites 2 Spice Blocks 2 Carousel, Recent Post Slider and Banner Slider 1 SpicePress 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.8
    CVE-2026-39621

    WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: from n/a through <= 2.3.2.5.

    spicethemes SpicePress
  • High 8.8
    CVE-2025-12821

    NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation

    The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.5.9. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthen…

    spicethemes NewsBlogger Web / CMS
  • High 7.5
    CVE-2025-48130

    WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through <= 2.0.7.4.

    spicethemes Spice Blocks
  • High 8.8
    CVE-2025-1305

    NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation

    The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possib…

    spicethemes NewsBlogger Web / CMS
  • High 8.8
    CVE-2025-1304 Public exploit

    NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload

    The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated att…

    spicethemes NewsBlogger Web / CMS
  • High 7.5
    CVE-2025-39532

    WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in spicethemes Spice Blocks spice-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spice Blocks: from n/a through <= 2.0.7.7.

    spicethemes Spice Blocks
  • High 8.8
    CVE-2025-1306 Public exploit

    Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload

    The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible f…

    spicethemes Newscrunch Web / CMS
  • High 7.1
    CVE-2024-44003

    WordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through <= 1.2.5.

    spicethemes Spice Starter Sites