SP
Vendor
spicethemes
12
CVEs
0
On KEV
0
New 30D
Products
NE8.8
NewsBlogger
spicethemes
3 CVEs0 on KEV0 new
CR6.1
Carousel, Recent Post Slider and Banner Slider
spicethemes
2 CVEs0 on KEV0 new
NE9.8
Newscrunch
spicethemes
2 CVEs0 on KEV0 new
SB7.5
Spice Blocks
spicethemes
2 CVEs0 on KEV0 new
SS6.1
Spice Starter Sites
spicethemes
2 CVEs0 on KEV0 new
SP8.8
SpicePress
spicethemes
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-13362 | CR Carousel, Recent Post Slider and Banner Slider spicethemes | 6.1 | May 1 | Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter |
| CVE-2026-39621 | SP SpicePress spicethemes | 8.8 | Apr 8 | WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability |
| CVE-2025-12821 | NE NewsBlogger spicethemes | 8.8 | Feb 19 | NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation |
| CVE-2025-48130 | SB Spice Blocks spicethemes | 7.5 | Jun 9 | WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability |
| CVE-2025-1304 | NE NewsBlogger spicethemes | 8.8 | May 1 | NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload |
| CVE-2025-1305 | NE NewsBlogger spicethemes | 8.8 | May 1 | NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation |
| CVE-2025-39532 | SB Spice Blocks spicethemes | 7.5 | Apr 17 | WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability |
| CVE-2025-1307 | NE Newscrunch spicethemes | 9.8 | Mar 4 | Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload |
| CVE-2025-1306 | NE Newscrunch spicethemes | 8.8 | Mar 4 | Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload |
| CVE-2024-8430 | SS Spice Starter Sites spicethemes | 5.3 | Oct 1 | Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import |
| CVE-2024-44003 | SS Spice Starter Sites spicethemes | 6.1 | Sep 17 | WordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability |
| CVE-2023-5362 | CR Carousel, Recent Post Slider And Banner Slider Spicethemes | 5.4 | Oct 30 | The Carousel, Recent Post Slider and Banner Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'spice_post_slider' shortcode in versions up to, and… |