spicethemes
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| NewsBlogger | 3 | – | Feb 19, 2026 |
| Carousel, Recent Post Slider and Banner Slider | 2 | – | May 1, 2026 |
| Newscrunch | 2 | – | Mar 4, 2025 |
| Spice Blocks | 2 | – | Jun 9, 2025 |
| Spice Starter Sites | 2 | – | Oct 1, 2024 |
| SpicePress | 1 | – | Apr 8, 2026 |
Exploited and recent CVEs
- CVE-2024-13362 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter 0.3%
- CVE-2026-39621 WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability 0.1%
- CVE-2025-12821 NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation 0.4%
- CVE-2025-48130 WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability 0.5%
- CVE-2025-1304 NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload 1.2%
- CVE-2025-1305 NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation 0.4%
- CVE-2025-39532 WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability 0.4%
- CVE-2025-1307 Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload 2.2%
- CVE-2025-1306 Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload 0.5%
- CVE-2024-8430 Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import 0.3%
- CVE-2024-44003 WordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability 0.3%
- CVE-2023-5362 Carousel, Recent Post Slider and Banner Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.6%