Skip to content
OpenAdvisories

Vendor

spicethemes

11 known vulnerabilities.

Products

NewsBlogger 3 Newscrunch 2 Spice Starter Sites 2 Spice Blocks 2 Carousel, Recent Post Slider and Banner Slider 1 SpicePress 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2025-1304 Public exploit

    NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload

    The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated att…

    spicethemes NewsBlogger Web / CMS
  • High 8.8
    CVE-2025-1306 Public exploit

    Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload

    The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible f…

    spicethemes Newscrunch Web / CMS