SP
Vendor
spicethemes
9
CVEs
0
On KEV
0
New 30D
Products
NE8.8
NewsBlogger
spicethemes
3 CVEs0 on KEV0 new
CR6.1
Carousel, Recent Post Slider and Banner Slider
spicethemes
2 CVEs0 on KEV0 new
NE9.8
Newscrunch
Spicethemes
2 CVEs0 on KEV0 new
SS6.1
Spice Starter Sites
Spicethemes
1 CVEs0 on KEV0 new
SP8.8
SpicePress
spicethemes
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-13362 | CR Carousel, Recent Post Slider and Banner Slider spicethemes | 6.1 | May 1 | Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter |
| CVE-2026-39621 | SP SpicePress spicethemes | 8.8 | Apr 8 | WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability |
| CVE-2025-12821 | NE NewsBlogger spicethemes | 8.8 | Feb 19 | NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation |
| CVE-2025-1305 | NE Newsblogger Spicethemes | 8.8 | May 1 | The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4 |
| CVE-2025-1304 | NE Newsblogger Spicethemes | 8.8 | May 1 | The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all… |
| CVE-2025-1307 | NE Newscrunch Spicethemes | 9.8 | Mar 4 | The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all… |
| CVE-2025-1306 | NE Newscrunch Spicethemes | 8.8 | Mar 4 | The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4 |
| CVE-2024-44003 | SS Spice Starter Sites Spicethemes | 6.1 | Sep 18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.This… |
| CVE-2023-5362 | CR Carousel, Recent Post Slider And Banner Slider Spicethemes | 5.4 | Oct 30 | The Carousel, Recent Post Slider and Banner Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'spice_post_slider' shortcode in versions up to, and… |