Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

12 vulnerabilities by spicethemes

CVE-2024-13362 (GCVE-0-2024-13362)

Vulnerability from cvelistv5 – Published: 2026-05-01 05:29 – Updated: 2026-05-01 13:23
VLAI?
Title
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Summary
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity ?
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
sebet Go Fetch Jobs (for WP Job Manager) Affected: 0 , ≤ 1.8.4.8.1 (semver)
Create a notification for this product.
    5starplugins Dynamic Copyright Year Affected: 0 , ≤ 1.0.4 (semver)
Create a notification for this product.
    peterschulznl Code Manager Affected: 0 , ≤ 1.0.40 (semver)
Create a notification for this product.
    bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior Affected: 0 , ≤ 1.1.3 (semver)
Create a notification for this product.
    yuvalo Goal Tracker – Custom Event Tracking for GA4 Affected: 0 , ≤ 1.1.5 (semver)
Create a notification for this product.
    essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent Affected: 0 , ≤ 1.1.13 (semver)
Create a notification for this product.
    josevega WP Page Templates Affected: 0 , ≤ 1.1.16 (semver)
Create a notification for this product.
    hkdigitalagency Payment Gateway for ACBA BANK Affected: 0 , ≤ 1.2.6 (semver)
Create a notification for this product.
    princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress Affected: 0 , ≤ 1.2.7 (semver)
Create a notification for this product.
    spiderdevs Forumax – AI Powered Advanced Community Forum Plugin Affected: 0 , ≤ 1.2.7 (semver)
Create a notification for this product.
    seezee Five-Star Ratings Shortcode Affected: 0 , ≤ 1.2.56 (semver)
Create a notification for this product.
    oxilab Product Layouts for WooCommerce Affected: 0 , ≤ 1.3.1 (semver)
Create a notification for this product.
    mr2p Meta Field Block – Display custom fields in the Block Editor without coding Affected: 0 , ≤ 1.3.3 (semver)
Create a notification for this product.
    themelocation Custom WooCommerce Checkout Fields Editor Affected: 0 , ≤ 1.3.4 (semver)
Create a notification for this product.
    100plugins Open User Map Affected: 0 , ≤ 1.4.0 (semver)
Create a notification for this product.
    wpdever WP Notification Bell Affected: 0 , ≤ 1.4.2 (semver)
Create a notification for this product.
    themelocation Remove Add to Cart WooCommerce Affected: 0 , ≤ 1.4.7 (semver)
Create a notification for this product.
    princeahmed File Manager for Google Drive – Integrate Google Drive Affected: 0 , ≤ 1.4.9 (semver)
Create a notification for this product.
    5starplugins Marijuana Age Verify Affected: 0 , ≤ 1.5.5 (semver)
Create a notification for this product.
    infosatech RevivePress – Keep your Old Content Evergreen Affected: 0 , ≤ 1.5.8 (semver)
Create a notification for this product.
    nicheaddons Restaurant & Cafe Addon for Elementor Affected: 0 , ≤ 1.5.8 (semver)
Create a notification for this product.
    paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter Affected: 0 , ≤ 1.5.10 (semver)
Create a notification for this product.
    unitecms Unlimited Elements For Elementor Affected: 0 , ≤ 1.5.140 (semver)
Create a notification for this product.
    meowcrew Role Based Pricing for Woo by Meow Crew Affected: 0 , ≤ 1.6.0 (semver)
Create a notification for this product.
    nicheaddons Primary Addon for Elementor Affected: 0 , ≤ 1.6.0 (semver)
Create a notification for this product.
    5starplugins Featured Images in RSS for Mailchimp & More Affected: 0 , ≤ 1.6.3 (semver)
Create a notification for this product.
    wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI Affected: 0 , ≤ 1.6.3 (semver)
Create a notification for this product.
    kofimokome Message Filter for Contact Form 7 Affected: 0 , ≤ 1.6.3.2 (semver)
Create a notification for this product.
    paretodigital Embedder for Google Reviews Affected: 0 , ≤ 1.6.6 (semver)
Create a notification for this product.
    interactivegeomaps MapGeo – Interactive Geo Maps Affected: 0 , ≤ 1.6.22 (semver)
Create a notification for this product.
    wpbits WPBITS Addons For Elementor Page Builder Affected: 0 , ≤ 1.7 (semver)
Create a notification for this product.
    toddhalfpenny Widgets on Pages Affected: 0 , ≤ 1.7 (semver)
Create a notification for this product.
    rebelcode Spotlight Social Feeds – Block, Shortcode, and Widget Affected: 0 , ≤ 1.7.0 (semver)
Create a notification for this product.
    tobias_conrad WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms Affected: 0 , ≤ 1.7.0 (semver)
Create a notification for this product.
    webfactory AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o Affected: 0 , ≤ 1.7.2 (semver)
Create a notification for this product.
    hasanazizul Text To Speech TTS Accessibility Affected: 0 , ≤ 1.7.34 (semver)
Create a notification for this product.
    5starplugins Easy Age Verify Affected: 0 , ≤ 1.8.5 (semver)
Create a notification for this product.
    senols AI Puffer – Chat. Create. Automate. (formerly AI Power) Affected: 0 , ≤ 1.8.99 (semver)
Create a notification for this product.
    damian-gora Justified Gallery Affected: 0 , ≤ 1.9.0 (semver)
Create a notification for this product.
    mapster Mapster WP Maps Affected: 0 , ≤ 1.9.0 (semver)
Create a notification for this product.
    streamweasels StreamWeasels Twitch Integration Affected: 0 , ≤ 1.9.2 (semver)
Create a notification for this product.
    xplodedthemes XT Variation Swatches for WooCommerce Affected: 0 , ≤ 1.9.4 (semver)
Create a notification for this product.
    bplugins bBlocks – Essential Gutenberg Blocks & Patterns Collection Affected: 0 , ≤ 1.9.8 (semver)
Create a notification for this product.
    kaizencoders URL Shortify – Simple and Easy URL Shortener Affected: 0 , ≤ 1.10.4 (semver)
Create a notification for this product.
    uriahs-victor Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce Affected: 0 , ≤ 1.10.6 (semver)
Create a notification for this product.
    cyberhobo Geo Mashup Affected: 0 , ≤ 1.13.15 (semver)
Create a notification for this product.
    josevega Disable Payment Methods based on cart conditions for WooCommerce Affected: 0 , ≤ 1.16.3 (semver)
Create a notification for this product.
    pagup Automatic Internal Links for SEO by Pagup Affected: 0 , ≤ 2.0.0 (semver)
Create a notification for this product.
    enweby Full Screen Background Affected: 0 , ≤ 2.0.2 (semver)
Create a notification for this product.
    litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Affected: 0 , ≤ 2.0.7.2 (semver)
Create a notification for this product.
    princeahmed Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player Affected: 0 , ≤ 2.0.82 (semver)
Create a notification for this product.
    spicethemes Carousel, Recent Post Slider and Banner Slider Affected: 0 , ≤ 2.1 (semver)
Create a notification for this product.
    pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) Affected: 0 , ≤ 2.1.0 (semver)
Create a notification for this product.
    xplodedthemes XT Quick View for WooCommerce Affected: 0 , ≤ 2.1.5 (semver)
Create a notification for this product.
    pluginscafe Smart phone field for Gravity Forms Affected: 0 , ≤ 2.1.6 (semver)
Create a notification for this product.
    fooplugins Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar Affected: 0 , ≤ 2.1.34 (semver)
Create a notification for this product.
    bplugins PDF Poster – Display PDF Files with Custom Viewer Affected: 0 , ≤ 2.2.0 (semver)
Create a notification for this product.
    nicheaddons Events Addon for Elementor Affected: 0 , ≤ 2.2.2 (semver)
Create a notification for this product.
    bplugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player Affected: 0 , ≤ 2.2.27 (semver)
Create a notification for this product.
    mte90 Glossary Affected: 0 , ≤ 2.2.38 (semver)
Create a notification for this product.
    tickera Restrict – membership, site, content and user access restrictions for WordPress Affected: 0 , ≤ 2.3.0 (semver)
Create a notification for this product.
    cyclonecode Custom PHP Settings Affected: 0 , ≤ 2.3.1 (semver)
Create a notification for this product.
    prasadkirpekar WP Meta and Date Remover Affected: 0 , ≤ 2.3.4 (semver)
Create a notification for this product.
    fullworks Anti-Spam Protection – No API Key, GDPR Friendly Affected: 0 , ≤ 2.3.7 (semver)
Create a notification for this product.
    premmerce Premmerce Permalink Manager for WooCommerce Affected: 0 , ≤ 2.3.11 (semver)
Create a notification for this product.
    smartwpress Music Player for Elementor – Audio Player & Podcast Player Affected: 0 , ≤ 2.4.1 (semver)
Create a notification for this product.
    mhmrajib TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More Affected: 0 , ≤ 2.4.1 (semver)
Create a notification for this product.
    oceanwp Ocean Extra Affected: 0 , ≤ 2.4.2 (semver)
Create a notification for this product.
    fooplugins Gallery by FooGallery Affected: 0 , ≤ 2.4.27 (semver)
Create a notification for this product.
    plugins360 Automatic YouTube Gallery Affected: 0 , ≤ 2.5.5 (semver)
Create a notification for this product.
    spiderdevs EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder Affected: 0 , ≤ 2.5.7 (semver)
Create a notification for this product.
    samdani Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More Affected: 0 , ≤ 2.5.8 (semver)
Create a notification for this product.
    tonyzeoli Radio Station by netmix® – Manage and play your Show Schedule in WordPress! Affected: 0 , ≤ 2.5.9 (semver)
Create a notification for this product.
    kaira StoreCustomizer – A plugin to Customize all WooCommerce Pages Affected: 0 , ≤ 2.5.9 (semver)
Create a notification for this product.
    wpjoli Joli Table Of Contents Affected: 0 , ≤ 2.6.0 (semver)
Create a notification for this product.
    passionatebrains GA4WP – Analytics Dashboard for the Website Affected: 0 , ≤ 2.6.0 (semver)
Create a notification for this product.
    nitin247 Place Order Without Payment for WooCommerce Affected: 0 , ≤ 2.6.5 (semver)
Create a notification for this product.
    wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages Affected: 0 , ≤ 2.6.7 (semver)
Create a notification for this product.
    mihail-barinov Share This Image Affected: 0 , ≤ 2.07 (semver)
Create a notification for this product.
    inavii Inavii Social Feed Affected: 0 , ≤ 2.7.0 (semver)
Create a notification for this product.
    fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox Affected: 0 , ≤ 2.7.33 (semver)
Create a notification for this product.
    xplodedthemes XT Floating Cart for WooCommerce Affected: 0 , ≤ 2.8.4 (semver)
Create a notification for this product.
    takanakui WP Mobile Menu – The Mobile-Friendly Responsive Menu Affected: 0 , ≤ 2.8.6 (semver)
Create a notification for this product.
    passionatebrains AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization Affected: 0 , ≤ 2.9.2 (semver)
Create a notification for this product.
    bensibley Independent Analytics Affected: 0 , ≤ 2.9.7 (semver)
Create a notification for this product.
    codesavory Knowledge Base documentation & wiki plugin – BasePress Docs Affected: 0 , ≤ 2.16.3.3 (semver)
Create a notification for this product.
    davidanderson Internal Link Juicer: SEO Auto Linker for WordPress Affected: 0 , ≤ 2.24.6 (semver)
Create a notification for this product.
    josevega Bulk Edit Posts and Products in Spreadsheet Affected: 0 , ≤ 2.25.16 (semver)
Create a notification for this product.
    saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Affected: 0 , ≤ 3.0.0 (semver)
Create a notification for this product.
    tobiasbg TablePress – Tables in WordPress made easy Affected: 0 , ≤ 3.0.2 (semver)
Create a notification for this product.
    bouncingsprout Ultimeter Affected: 0 , ≤ 3.0.5 (semver)
Create a notification for this product.
    blackandwhitedigital TreePress – Easy Family Trees & Ancestor Profiles Affected: 0 , ≤ 3.0.6 (semver)
Create a notification for this product.
    mattpramschufer Pay For Post with WooCommerce Affected: 0 , ≤ 3.1.26 (semver)
Create a notification for this product.
    koen12344 Post to Google My Business (Google Business Profile) Affected: 0 , ≤ 3.1.28 (semver)
Create a notification for this product.
    imtiazrayhan WP Coupons and Deals – Coupon Plugin For Affiliate Marketers Affected: 0 , ≤ 3.2.2 (semver)
Create a notification for this product.
    pluginsware Advanced Classifieds & Directory Pro Affected: 0 , ≤ 3.2.4 (semver)
Create a notification for this product.
    gallerycreator Mixed Media Gallery Blocks Affected: 0 , ≤ 3.2.4.4 (semver)
Create a notification for this product.
    blockspare BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor Affected: 0 , ≤ 3.2.6 (semver)
Create a notification for this product.
    mhmrajib AidWP – Donation & Payment Forms (Stripe Powered) Affected: 0 , ≤ 3.2.6 (semver)
Create a notification for this product.
    infornweb Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid Affected: 0 , ≤ 3.2.7 (semver)
Create a notification for this product.
    pluginandplay Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider Affected: 0 , ≤ 3.2.7 (semver)
Create a notification for this product.
    samdani Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews Affected: 0 , ≤ 3.2.8 (semver)
Create a notification for this product.
    wpspeedo Team Members Showcase Affected: 0 , ≤ 3.3.0 (semver)
Create a notification for this product.
    elespare EleSpare – News, Magazine and Blog Addons for Elementor Affected: 0 , ≤ 3.3.2 (semver)
Create a notification for this product.
    infornweb Post List Designer – Category Post, Recent Post, Post List Affected: 0 , ≤ 3.3.7 (semver)
Create a notification for this product.
    infornweb Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News Affected: 0 , ≤ 3.4.9 (semver)
Create a notification for this product.
    dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress Affected: 0 , ≤ 3.4.12 (semver)
Create a notification for this product.
    xplodedthemes WPIDE – File Manager & Code Editor Affected: 0 , ≤ 3.5.1 (semver)
Create a notification for this product.
    premmerce Premmerce Product Filter for WooCommerce Affected: 0 , ≤ 3.7.3 (semver)
Create a notification for this product.
    afthemes WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars Affected: 0 , ≤ 3.8.3 (semver)
Create a notification for this product.
    wpmagics Delete Posts automatically Affected: 0 , ≤ 3.9.6 (semver)
Create a notification for this product.
    takanakui Menu Image, Icons made easy Affected: 0 , ≤ 3.12 (semver)
Create a notification for this product.
    passionatebrains AWCA – The Great Analytics Insights for Your eStore Affected: 0 , ≤ 3.12.0 (semver)
Create a notification for this product.
    mikewire_rocksolid Announcement & Notification Banner – Bulletin Affected: 0 , ≤ 3.12.1 (semver)
Create a notification for this product.
    nitin247 Thank You Page for WooCommerce Affected: 0 , ≤ 4.2.0 (semver)
Create a notification for this product.
    webheadllc Contact Form 7 Multi-Step Forms Affected: 0 , ≤ 4.4.1 (semver)
Create a notification for this product.
    speedify Auto-Install Free SSL – Generate & Install Free SSL Certificates Affected: 0 , ≤ 4.5.0 (semver)
Create a notification for this product.
    mhmrajib WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes Affected: 0 , ≤ 4.6.8 (semver)
Create a notification for this product.
    webba-agency Easy Appointment Booking & Scheduling System – Webba Booking Calendar Affected: 0 , ≤ 5.0.57 (semver)
Create a notification for this product.
    invisnet WP fail2ban – Advanced Security Affected: 0 , ≤ 5.3.4 (semver)
Create a notification for this product.
    vinod-dalvi Ivory Search – WordPress Search Plugin Affected: 0 , ≤ 5.5.8 (semver)
Create a notification for this product.
    peterschulznl WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards Affected: 0 , ≤ 5.5.31 (semver)
Create a notification for this product.
    elliotvs Coupon Affiliates – Affiliate Plugin for WooCommerce Affected: 0 , ≤ 5.17.2 (semver)
Create a notification for this product.
    cleverplugins Security Ninja – WordPress Security & Firewall Affected: 0 , ≤ 5.222 (semver)
Create a notification for this product.
    theafricanboss Checkout with Cash App on WooCommerce Affected: 0 , ≤ 6.0.2 (semver)
Create a notification for this product.
    fullworks Display Eventbrite Events Affected: 0 , ≤ 6.1.10 (semver)
Create a notification for this product.
    mohsinoffline Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins Affected: 0 , ≤ 6.1.13 (semver)
Create a notification for this product.
    sjaved Easy Social Feed – Social Photos Gallery and Post Feed for WordPress Affected: 0 , ≤ 6.6.5 (semver)
Create a notification for this product.
    gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.3.3 (semver)
Create a notification for this product.
    gowebsmarty WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan Affected: 0 , ≤ 7.7.0 (semver)
Create a notification for this product.
    tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto Affected: 0 , ≤ 8.0.7 (semver)
Create a notification for this product.
Credits
Asaf Mozes
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-13362",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-01T13:23:14.835839Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-01T13:23:26.723Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Go Fetch Jobs (for WP Job Manager)",
          "vendor": "sebet",
          "versions": [
            {
              "lessThanOrEqual": "1.8.4.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dynamic Copyright Year",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Code Manager",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "1.0.40",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Scrollbar \u2013 Custom Scrollbar Styling and Behavior",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Goal Tracker \u2013 Custom Event Tracking for GA4",
          "vendor": "yuvalo",
          "versions": [
            {
              "lessThanOrEqual": "1.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent",
          "vendor": "essekia",
          "versions": [
            {
              "lessThanOrEqual": "1.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Page Templates",
          "vendor": "josevega",
          "versions": [
            {
              "lessThanOrEqual": "1.1.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Payment Gateway for ACBA BANK",
          "vendor": "hkdigitalagency",
          "versions": [
            {
              "lessThanOrEqual": "1.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dracula Dark Mode \u2013  Accessibility, Reading Mode \u0026 Dark Mode for WordPress",
          "vendor": "princeahmed",
          "versions": [
            {
              "lessThanOrEqual": "1.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Forumax \u2013 AI Powered Advanced Community Forum Plugin",
          "vendor": "spiderdevs",
          "versions": [
            {
              "lessThanOrEqual": "1.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Five-Star Ratings Shortcode",
          "vendor": "seezee",
          "versions": [
            {
              "lessThanOrEqual": "1.2.56",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Product Layouts for WooCommerce",
          "vendor": "oxilab",
          "versions": [
            {
              "lessThanOrEqual": "1.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Meta Field Block \u2013 Display custom fields in the Block Editor without coding",
          "vendor": "mr2p",
          "versions": [
            {
              "lessThanOrEqual": "1.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Custom WooCommerce Checkout Fields Editor",
          "vendor": "themelocation",
          "versions": [
            {
              "lessThanOrEqual": "1.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Open User Map",
          "vendor": "100plugins",
          "versions": [
            {
              "lessThanOrEqual": "1.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Notification Bell",
          "vendor": "wpdever",
          "versions": [
            {
              "lessThanOrEqual": "1.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Remove Add to Cart WooCommerce",
          "vendor": "themelocation",
          "versions": [
            {
              "lessThanOrEqual": "1.4.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "File Manager for Google Drive \u2013 Integrate Google Drive",
          "vendor": "princeahmed",
          "versions": [
            {
              "lessThanOrEqual": "1.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Marijuana Age Verify",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "RevivePress \u2013 Keep your Old Content Evergreen",
          "vendor": "infosatech",
          "versions": [
            {
              "lessThanOrEqual": "1.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Restaurant \u0026 Cafe Addon for Elementor",
          "vendor": "nicheaddons",
          "versions": [
            {
              "lessThanOrEqual": "1.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Send Users Email \u2013 Email Subscribers, Email Marketing Newsletter",
          "vendor": "paretodigital",
          "versions": [
            {
              "lessThanOrEqual": "1.5.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Unlimited Elements For Elementor",
          "vendor": "unitecms",
          "versions": [
            {
              "lessThanOrEqual": "1.5.140",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Role Based Pricing for Woo by Meow Crew",
          "vendor": "meowcrew",
          "versions": [
            {
              "lessThanOrEqual": "1.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Primary Addon for Elementor",
          "vendor": "nicheaddons",
          "versions": [
            {
              "lessThanOrEqual": "1.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Featured Images in RSS for Mailchimp \u0026 More",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Image Alt Text Manager \u2013 Bulk \u0026 Dynamic Alt Tags For image SEO Optimization + AI",
          "vendor": "wpsaad",
          "versions": [
            {
              "lessThanOrEqual": "1.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Message Filter for Contact Form 7",
          "vendor": "kofimokome",
          "versions": [
            {
              "lessThanOrEqual": "1.6.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Embedder for Google Reviews",
          "vendor": "paretodigital",
          "versions": [
            {
              "lessThanOrEqual": "1.6.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MapGeo \u2013 Interactive Geo Maps",
          "vendor": "interactivegeomaps",
          "versions": [
            {
              "lessThanOrEqual": "1.6.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WPBITS Addons For Elementor Page Builder",
          "vendor": "wpbits",
          "versions": [
            {
              "lessThanOrEqual": "1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Widgets on Pages",
          "vendor": "toddhalfpenny",
          "versions": [
            {
              "lessThanOrEqual": "1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spotlight Social Feeds \u2013 Block, Shortcode, and Widget",
          "vendor": "rebelcode",
          "versions": [
            {
              "lessThanOrEqual": "1.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms",
          "vendor": "tobias_conrad",
          "versions": [
            {
              "lessThanOrEqual": "1.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AI Bud \u2013 AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o",
          "vendor": "webfactory",
          "versions": [
            {
              "lessThanOrEqual": "1.7.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Text To Speech TTS Accessibility",
          "vendor": "hasanazizul",
          "versions": [
            {
              "lessThanOrEqual": "1.7.34",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Easy Age Verify",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AI Puffer \u2013 Chat. Create. Automate. (formerly AI Power)",
          "vendor": "senols",
          "versions": [
            {
              "lessThanOrEqual": "1.8.99",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Justified Gallery",
          "vendor": "damian-gora",
          "versions": [
            {
              "lessThanOrEqual": "1.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mapster WP Maps",
          "vendor": "mapster",
          "versions": [
            {
              "lessThanOrEqual": "1.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "StreamWeasels Twitch Integration",
          "vendor": "streamweasels",
          "versions": [
            {
              "lessThanOrEqual": "1.9.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XT Variation Swatches for WooCommerce",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "1.9.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "bBlocks \u2013 Essential Gutenberg Blocks \u0026 Patterns Collection",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.9.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "URL Shortify \u2013 Simple and Easy URL Shortener",
          "vendor": "kaizencoders",
          "versions": [
            {
              "lessThanOrEqual": "1.10.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Kikote \u2013 Location Picker at Checkout \u0026 Google Address AutoFill Plugin for WooCommerce",
          "vendor": "uriahs-victor",
          "versions": [
            {
              "lessThanOrEqual": "1.10.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Geo Mashup",
          "vendor": "cyberhobo",
          "versions": [
            {
              "lessThanOrEqual": "1.13.15",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Disable Payment Methods based on cart conditions for WooCommerce",
          "vendor": "josevega",
          "versions": [
            {
              "lessThanOrEqual": "1.16.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Automatic Internal Links for SEO by Pagup",
          "vendor": "pagup",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Full Screen Background",
          "vendor": "enweby",
          "versions": [
            {
              "lessThanOrEqual": "2.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder \u0026 Template Kits",
          "vendor": "litonice13",
          "versions": [
            {
              "lessThanOrEqual": "2.0.7.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player",
          "vendor": "princeahmed",
          "versions": [
            {
              "lessThanOrEqual": "2.0.82",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Carousel, Recent Post Slider and Banner Slider",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)",
          "vendor": "pagup",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XT Quick View for WooCommerce",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Smart phone field for Gravity Forms",
          "vendor": "pluginscafe",
          "versions": [
            {
              "lessThanOrEqual": "2.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Notification Bar, Announcement and Cookie Notice WordPress Plugin \u2013 FooBar",
          "vendor": "fooplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.1.34",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PDF Poster \u2013 Display PDF Files with Custom Viewer",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Events Addon for Elementor",
          "vendor": "nicheaddons",
          "versions": [
            {
              "lessThanOrEqual": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 \u0026 Audio Player",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.2.27",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Glossary",
          "vendor": "mte90",
          "versions": [
            {
              "lessThanOrEqual": "2.2.38",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Restrict \u2013 membership, site, content and user access restrictions for WordPress",
          "vendor": "tickera",
          "versions": [
            {
              "lessThanOrEqual": "2.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Custom PHP Settings",
          "vendor": "cyclonecode",
          "versions": [
            {
              "lessThanOrEqual": "2.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Meta and Date Remover",
          "vendor": "prasadkirpekar",
          "versions": [
            {
              "lessThanOrEqual": "2.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Anti-Spam Protection \u2013 No API Key, GDPR Friendly",
          "vendor": "fullworks",
          "versions": [
            {
              "lessThanOrEqual": "2.3.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Premmerce Permalink Manager for WooCommerce",
          "vendor": "premmerce",
          "versions": [
            {
              "lessThanOrEqual": "2.3.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Music Player for Elementor \u2013 Audio Player \u0026 Podcast Player",
          "vendor": "smartwpress",
          "versions": [
            {
              "lessThanOrEqual": "2.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TopNewsWp \u2013 Display Tikcer News, RSS Feed Widget and Many More",
          "vendor": "mhmrajib",
          "versions": [
            {
              "lessThanOrEqual": "2.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Ocean Extra",
          "vendor": "oceanwp",
          "versions": [
            {
              "lessThanOrEqual": "2.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Gallery by FooGallery",
          "vendor": "fooplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.4.27",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Automatic YouTube Gallery",
          "vendor": "plugins360",
          "versions": [
            {
              "lessThanOrEqual": "2.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation \u0026 FAQ Builder",
          "vendor": "spiderdevs",
          "versions": [
            {
              "lessThanOrEqual": "2.5.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Team Members \u2013 A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More",
          "vendor": "samdani",
          "versions": [
            {
              "lessThanOrEqual": "2.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress!",
          "vendor": "tonyzeoli",
          "versions": [
            {
              "lessThanOrEqual": "2.5.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "StoreCustomizer \u2013 A plugin to Customize all WooCommerce Pages",
          "vendor": "kaira",
          "versions": [
            {
              "lessThanOrEqual": "2.5.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Joli Table Of Contents",
          "vendor": "wpjoli",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GA4WP \u2013 Analytics Dashboard for the Website",
          "vendor": "passionatebrains",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Place Order Without Payment for WooCommerce",
          "vendor": "nitin247",
          "versions": [
            {
              "lessThanOrEqual": "2.6.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Better Messages \u2013 Live Chat, Chat Rooms, Real-Time Messaging \u0026 Private Messages",
          "vendor": "wordplus",
          "versions": [
            {
              "lessThanOrEqual": "2.6.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Share This Image",
          "vendor": "mihail-barinov",
          "versions": [
            {
              "lessThanOrEqual": "2.07",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Inavii Social Feed",
          "vendor": "inavii",
          "versions": [
            {
              "lessThanOrEqual": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Lightbox \u0026 Modal Popup WordPress Plugin \u2013 FooBox",
          "vendor": "fooplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.7.33",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XT Floating Cart for WooCommerce",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "2.8.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu",
          "vendor": "takanakui",
          "versions": [
            {
              "lessThanOrEqual": "2.8.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading \u0026 Image Optimization",
          "vendor": "passionatebrains",
          "versions": [
            {
              "lessThanOrEqual": "2.9.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Independent Analytics",
          "vendor": "bensibley",
          "versions": [
            {
              "lessThanOrEqual": "2.9.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Knowledge Base documentation \u0026 wiki plugin \u2013 BasePress Docs",
          "vendor": "codesavory",
          "versions": [
            {
              "lessThanOrEqual": "2.16.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Internal Link Juicer: SEO Auto Linker for WordPress",
          "vendor": "davidanderson",
          "versions": [
            {
              "lessThanOrEqual": "2.24.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Bulk Edit Posts and Products in Spreadsheet",
          "vendor": "josevega",
          "versions": [
            {
              "lessThanOrEqual": "2.25.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TablePress \u2013 Tables in WordPress made easy",
          "vendor": "tobiasbg",
          "versions": [
            {
              "lessThanOrEqual": "3.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Ultimeter",
          "vendor": "bouncingsprout",
          "versions": [
            {
              "lessThanOrEqual": "3.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TreePress \u2013 Easy Family Trees \u0026 Ancestor Profiles",
          "vendor": "blackandwhitedigital",
          "versions": [
            {
              "lessThanOrEqual": "3.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Pay For Post with WooCommerce",
          "vendor": "mattpramschufer",
          "versions": [
            {
              "lessThanOrEqual": "3.1.26",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post to Google My Business (Google Business Profile)",
          "vendor": "koen12344",
          "versions": [
            {
              "lessThanOrEqual": "3.1.28",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Coupons and Deals \u2013 Coupon Plugin For Affiliate Marketers",
          "vendor": "imtiazrayhan",
          "versions": [
            {
              "lessThanOrEqual": "3.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Classifieds \u0026 Directory Pro",
          "vendor": "pluginsware",
          "versions": [
            {
              "lessThanOrEqual": "3.2.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mixed Media Gallery Blocks",
          "vendor": "gallerycreator",
          "versions": [
            {
              "lessThanOrEqual": "3.2.4.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "BlockSpare \u2014 News, Magazine and Blog Addons for (Gutenberg) Block Editor",
          "vendor": "blockspare",
          "versions": [
            {
              "lessThanOrEqual": "3.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AidWP \u2013 Donation \u0026 Payment Forms (Stripe Powered)",
          "vendor": "mhmrajib",
          "versions": [
            {
              "lessThanOrEqual": "3.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Logo Showcase \u2013 Responsive Logo Carousel, Logo Slider \u0026 Logo Grid",
          "vendor": "infornweb",
          "versions": [
            {
              "lessThanOrEqual": "3.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post Slider and Post Carousel with Post Vertical Scrolling Widget \u2013 A Responsive Post Slider",
          "vendor": "pluginandplay",
          "versions": [
            {
              "lessThanOrEqual": "3.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Solid Testimonials \u2013 Testimonial Slider, Video Testimonials \u0026 Customer Reviews",
          "vendor": "samdani",
          "versions": [
            {
              "lessThanOrEqual": "3.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Team Members Showcase",
          "vendor": "wpspeedo",
          "versions": [
            {
              "lessThanOrEqual": "3.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EleSpare \u2013 News, Magazine and Blog Addons for Elementor",
          "vendor": "elespare",
          "versions": [
            {
              "lessThanOrEqual": "3.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post List Designer \u2013 Category Post, Recent Post, Post List",
          "vendor": "infornweb",
          "versions": [
            {
              "lessThanOrEqual": "3.3.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Blog Designer Pack \u2013 Blog, Post Grid, Post Slider, Post Carousel, Category Post, News",
          "vendor": "infornweb",
          "versions": [
            {
              "lessThanOrEqual": "3.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "YASR \u2013 Yet Another Star Rating Plugin for WordPress",
          "vendor": "dashlabsltd",
          "versions": [
            {
              "lessThanOrEqual": "3.4.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WPIDE \u2013 File Manager \u0026 Code Editor",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "3.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Premmerce Product Filter for WooCommerce",
          "vendor": "premmerce",
          "versions": [
            {
              "lessThanOrEqual": "3.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors \u0026 Custom Avatars",
          "vendor": "afthemes",
          "versions": [
            {
              "lessThanOrEqual": "3.8.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Delete Posts automatically",
          "vendor": "wpmagics",
          "versions": [
            {
              "lessThanOrEqual": "3.9.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Menu Image, Icons made easy",
          "vendor": "takanakui",
          "versions": [
            {
              "lessThanOrEqual": "3.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AWCA \u2013 The Great Analytics Insights for Your eStore",
          "vendor": "passionatebrains",
          "versions": [
            {
              "lessThanOrEqual": "3.12.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Announcement \u0026 Notification Banner \u2013 Bulletin",
          "vendor": "mikewire_rocksolid",
          "versions": [
            {
              "lessThanOrEqual": "3.12.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Thank You Page for WooCommerce",
          "vendor": "nitin247",
          "versions": [
            {
              "lessThanOrEqual": "4.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Contact Form 7 Multi-Step Forms",
          "vendor": "webheadllc",
          "versions": [
            {
              "lessThanOrEqual": "4.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Auto-Install Free SSL \u2013 Generate \u0026 Install Free SSL Certificates",
          "vendor": "speedify",
          "versions": [
            {
              "lessThanOrEqual": "4.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Books Gallery \u2013 Build Stunning Book Showcases \u0026 Libraries in Minutes",
          "vendor": "mhmrajib",
          "versions": [
            {
              "lessThanOrEqual": "4.6.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Easy Appointment Booking \u0026 Scheduling System \u2013 Webba Booking Calendar",
          "vendor": "webba-agency",
          "versions": [
            {
              "lessThanOrEqual": "5.0.57",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP fail2ban \u2013 Advanced Security",
          "vendor": "invisnet",
          "versions": [
            {
              "lessThanOrEqual": "5.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Ivory Search \u2013 WordPress Search Plugin",
          "vendor": "vinod-dalvi",
          "versions": [
            {
              "lessThanOrEqual": "5.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Data Access \u2013 App Builder for Tables, Forms, Charts, Maps \u0026 Dashboards",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "5.5.31",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce",
          "vendor": "elliotvs",
          "versions": [
            {
              "lessThanOrEqual": "5.17.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Security Ninja \u2013 WordPress Security \u0026 Firewall",
          "vendor": "cleverplugins",
          "versions": [
            {
              "lessThanOrEqual": "5.222",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Checkout with Cash App on WooCommerce",
          "vendor": "theafricanboss",
          "versions": [
            {
              "lessThanOrEqual": "6.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Display Eventbrite Events",
          "vendor": "fullworks",
          "versions": [
            {
              "lessThanOrEqual": "6.1.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins",
          "vendor": "mohsinoffline",
          "versions": [
            {
              "lessThanOrEqual": "6.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Easy Social Feed \u2013 Social Photos Gallery and Post Feed for WordPress",
          "vendor": "sjaved",
          "versions": [
            {
              "lessThanOrEqual": "6.6.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Encryption \u2013 One Click Free SSL Certificate \u0026 SSL / HTTPS Redirect, Security \u0026 SSL Scan",
          "vendor": "gowebsmarty",
          "versions": [
            {
              "lessThanOrEqual": "7.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto",
          "vendor": "tripetto",
          "versions": [
            {
              "lessThanOrEqual": "8.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asaf Mozes"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-01T05:29:54.148Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpide/tags/3.5.0/dist/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/master-addons/trunk/lib/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/internal-links/trunk/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/spotlight-social-photo-feeds/trunk/ui/freemius-pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-permalink-manager/tags/2.3.11/assets/admin/js/pricing-page/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/pdf-poster/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-meta-and-date-remover/tags/2.3.4/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3235286/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3249130/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3229060/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-30T17:32:32.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-04-30T17:17:30.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Freemius \u003c= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-13362",
    "datePublished": "2026-05-01T05:29:54.148Z",
    "dateReserved": "2025-01-13T18:08:47.439Z",
    "dateUpdated": "2026-05-01T13:23:26.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-39621 (GCVE-0-2026-39621)

Vulnerability from cvelistv5 – Published: 2026-04-08 08:30 – Updated: 2026-04-29 09:52
VLAI?
Title
WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability
Summary
Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: from n/a through <= 2.3.2.5.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
spicethemes SpicePress Affected: 0 , ≤ 2.3.2.5 (custom)
Create a notification for this product.
Date Public ?
2026-04-08 10:28
Credits
Trương Hữu Phúc (truonghuuphuc) | Patchstack Bug Bounty Program
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-39621",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-09T20:38:21.994621Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-09T20:38:32.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "spicepress",
          "product": "SpicePress",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "2.3.2.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc) | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-08T10:28:38.757Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.\u003cp\u003eThis issue affects SpicePress: from n/a through \u003c= 2.3.2.5.\u003c/p\u003e"
            }
          ],
          "value": "Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: from n/a through \u003c= 2.3.2.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-650",
          "descriptions": [
            {
              "lang": "en",
              "value": "Upload a Web Shell to a Web Server"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-29T09:52:02.618Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Theme/spicepress/vulnerability/wordpress-spicepress-theme-2-3-2-5-csrf-to-arbitrary-plugin-installation-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress SpicePress theme \u003c= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-39621",
    "datePublished": "2026-04-08T08:30:26.321Z",
    "dateReserved": "2026-04-07T10:57:27.974Z",
    "dateUpdated": "2026-04-29T09:52:02.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12821 (GCVE-0-2025-12821)

Vulnerability from cvelistv5 – Published: 2026-02-19 03:25 – Updated: 2026-02-19 17:41
VLAI?
Title
NewsBlogger <= 0.2.5.6 - 0.2.6.1 - Cross-Site Request Forgery to Arbitrary Plugin Installation
Summary
The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.6.1. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This is due to a reverted fix of CVE-2025-1305.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
spicethemes NewsBlogger Affected: 0.2.5.6 , ≤ 0.2.6.1 (semver)
Create a notification for this product.
Credits
lucky_buddy
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-19T17:07:28.767968Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-19T17:41:41.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NewsBlogger",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "0.2.6.1",
              "status": "affected",
              "version": "0.2.5.6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "lucky_buddy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6  to 0.2.6.1. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This is due to a reverted fix of CVE-2025-1305."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-19T03:25:16.877Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9f33096a-dfd5-48c1-84d8-30a0faa2a7f5?source=cve"
        },
        {
          "url": "https://themes.trac.wordpress.org/browser/newsblogger/0.2.5.8/functions.php#L499"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-18T15:08:47.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "NewsBlogger \u003c= 0.2.5.6 - 0.2.6.1 - Cross-Site Request Forgery to Arbitrary Plugin Installation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-12821",
    "datePublished": "2026-02-19T03:25:16.877Z",
    "dateReserved": "2025-11-06T18:29:47.045Z",
    "dateUpdated": "2026-02-19T17:41:41.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-48130 (GCVE-0-2025-48130)

Vulnerability from cvelistv5 – Published: 2025-06-09 15:54 – Updated: 2026-04-28 16:12
VLAI?
Title
WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through <= 2.0.7.4.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
Vendor Product Version
spicethemes Spice Blocks Affected: 0 , ≤ 2.0.7.4 (custom)
Create a notification for this product.
Date Public ?
2026-04-01 16:40
Credits
Martino Spagnuolo (r3verii) | Patchstack Bug Bounty Program
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-48130",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-10T13:42:33.416422Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-10T13:42:41.038Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "spice-blocks",
          "product": "Spice Blocks",
          "vendor": "spicethemes",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.0.7.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.0.7.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Martino Spagnuolo (r3verii) | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:40:39.489Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.\u003cp\u003eThis issue affects Spice Blocks: from n/a through \u003c= 2.0.7.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through \u003c= 2.0.7.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:12:52.327Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/spice-blocks/vulnerability/wordpress-spice-blocks-2-0-7-2-arbitrary-file-download-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Spice Blocks plugin \u003c= 2.0.7.4 - Arbitrary File Download vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-48130",
    "datePublished": "2025-06-09T15:54:01.031Z",
    "dateReserved": "2025-05-15T18:01:28.792Z",
    "dateUpdated": "2026-04-28T16:12:52.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-1305 (GCVE-0-2025-1305)

Vulnerability from cvelistv5 – Published: 2025-05-01 03:23 – Updated: 2026-04-08 17:02
VLAI?
Title
NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation
Summary
The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
spicethemes NewsBlogger Affected: 0 , ≤ 0.2.5.4 (semver)
Create a notification for this product.
Credits
Gibran Abdillah
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1305",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-01T13:22:47.012581Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-01T13:22:53.910Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NewsBlogger",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "0.2.5.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gibran Abdillah"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:02:27.057Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2cac27-4a36-490f-b2d8-3c6f32843a38?source=cve"
        },
        {
          "url": "https://themes.trac.wordpress.org/browser/newsblogger/0.2/functions.php#L440"
        },
        {
          "url": "https://themes.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=269615%40newsblogger\u0026new=269615%40newsblogger\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-30T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "NewsBlogger \u003c= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-1305",
    "datePublished": "2025-05-01T03:23:39.014Z",
    "dateReserved": "2025-02-14T19:00:13.000Z",
    "dateUpdated": "2026-04-08T17:02:27.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-1304 (GCVE-0-2025-1304)

Vulnerability from cvelistv5 – Published: 2025-05-01 03:23 – Updated: 2026-04-08 17:04
VLAI?
Title
NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload
Summary
The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Assigner
References
Impacted products
Vendor Product Version
spicethemes NewsBlogger Affected: 0 , ≤ 0.2.5.1 (semver)
Create a notification for this product.
Credits
Alexander Chikaylo
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1304",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-01T13:22:14.838248Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-01T13:22:21.753Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NewsBlogger",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "0.2.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexander Chikaylo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:04:40.080Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/85cea6b5-d57b-495e-a504-a0c1ba691637?source=cve"
        },
        {
          "url": "https://themes.trac.wordpress.org/browser/newsblogger/0.2/functions.php#L440"
        },
        {
          "url": "https://themes.trac.wordpress.org/browser/newsblogger/0.2/functions.php#L461"
        },
        {
          "url": "https://themes.trac.wordpress.org/browser/newsblogger/0.2/functions.php#L470"
        },
        {
          "url": "https://themes.trac.wordpress.org/browser/newsblogger/0.2.5.5/functions.php?annotate=blame\u0026rev=269615#file2"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-30T15:00:22.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "NewsBlogger \u003c= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-1304",
    "datePublished": "2025-05-01T03:23:39.579Z",
    "dateReserved": "2025-02-14T18:56:39.424Z",
    "dateUpdated": "2026-04-08T17:04:40.080Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39532 (GCVE-0-2025-39532)

Vulnerability from cvelistv5 – Published: 2025-04-17 15:46 – Updated: 2026-04-28 16:12
VLAI?
Title
WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in spicethemes Spice Blocks spice-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spice Blocks: from n/a through <= 2.0.7.7.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
spicethemes Spice Blocks Affected: 0 , ≤ 2.0.7.7 (custom)
Create a notification for this product.
Date Public ?
2026-04-01 16:39
Credits
0xd4rk5id3 | Patchstack Bug Bounty Program
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39532",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-17T17:42:46.983098Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-17T18:40:27.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "spice-blocks",
          "product": "Spice Blocks",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "2.0.7.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0xd4rk5id3 | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:39:28.514Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in spicethemes Spice Blocks spice-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Spice Blocks: from n/a through \u003c= 2.0.7.7.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in spicethemes Spice Blocks spice-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spice Blocks: from n/a through \u003c= 2.0.7.7."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:12:34.145Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/spice-blocks/vulnerability/wordpress-spice-blocks-2-0-7-1-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Spice Blocks plugin \u003c= 2.0.7.7 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-39532",
    "datePublished": "2025-04-17T15:46:54.592Z",
    "dateReserved": "2025-04-16T06:24:40.074Z",
    "dateUpdated": "2026-04-28T16:12:34.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-1307 (GCVE-0-2025-1307)

Vulnerability from cvelistv5 – Published: 2025-03-04 04:26 – Updated: 2026-04-08 17:17
VLAI?
Title
Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload
Summary
The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Assigner
References
Impacted products
Vendor Product Version
spicethemes Newscrunch Affected: 0 , ≤ 1.8.4 (semver)
Create a notification for this product.
Credits
Chloe Chamberland
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1307",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-04T15:28:58.852254Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-11T16:09:02.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Newscrunch",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "1.8.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Chloe Chamberland"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:17:09.343Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b55567e9-24e6-4738-b7f7-b95b541e6067?source=cve"
        },
        {
          "url": "https://themes.trac.wordpress.org/browser/newscrunch/1.8.3/functions.php#L486"
        },
        {
          "url": "https://themes.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=261789%40newscrunch\u0026new=261789%40newscrunch\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-03-03T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Newscrunch \u003c= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-1307",
    "datePublished": "2025-03-04T04:26:09.463Z",
    "dateReserved": "2025-02-14T19:07:01.515Z",
    "dateUpdated": "2026-04-08T17:17:09.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-1306 (GCVE-0-2025-1306)

Vulnerability from cvelistv5 – Published: 2025-03-04 04:26 – Updated: 2026-04-08 16:39
VLAI?
Title
Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload
Summary
The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
spicethemes Newscrunch Affected: 0 , ≤ 1.8.4 (semver)
Create a notification for this product.
Credits
Gibran Abdillah
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1306",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-04T15:25:03.567935Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-11T16:09:08.874Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Newscrunch",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "1.8.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gibran Abdillah"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:39:42.547Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1c507681-61e9-4bf0-8fe5-e2f401a7a8be?source=cve"
        },
        {
          "url": "https://themes.trac.wordpress.org/browser/newscrunch/1.8.3/functions.php#L486"
        },
        {
          "url": "https://themes.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=261789%40newscrunch\u0026new=261789%40newscrunch\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-03-03T15:46:15.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Newscrunch \u003c= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-1306",
    "datePublished": "2025-03-04T04:26:08.747Z",
    "dateReserved": "2025-02-14T19:04:18.268Z",
    "dateUpdated": "2026-04-08T16:39:42.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-8430 (GCVE-0-2024-8430)

Vulnerability from cvelistv5 – Published: 2024-10-01 08:30 – Updated: 2026-04-08 17:31
VLAI?
Title
Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import
Summary
The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_importer_creater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo content.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
spicethemes Spice Starter Sites Affected: 0 , ≤ 1.2.5 (semver)
Create a notification for this product.
Credits
Lucio Sá
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:spicethemes:spice_starter_sites:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "spice_starter_sites",
            "vendor": "spicethemes",
            "versions": [
              {
                "lessThanOrEqual": "1.2.5",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8430",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T13:28:08.660912Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T13:29:28.042Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spice Starter Sites",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "1.2.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lucio S\u00e1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_importer_creater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo content."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:31:24.143Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec52337f-bdd1-4632-853b-da86d64751e7?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/spice-starter-sites/tags/1.2.5/spice-starter-sites.php#L1123"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-09-30T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Spice Starter Sites \u003c= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-8430",
    "datePublished": "2024-10-01T08:30:19.110Z",
    "dateReserved": "2024-09-04T15:27:14.463Z",
    "dateUpdated": "2026-04-08T17:31:24.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-44003 (GCVE-0-2024-44003)

Vulnerability from cvelistv5 – Published: 2024-09-17 23:10 – Updated: 2026-04-28 16:10
VLAI?
Title
WordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through <= 1.2.5.
Severity ?
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
spicethemes Spice Starter Sites Affected: 0 , ≤ 1.2.5 (custom)
Create a notification for this product.
Date Public ?
2026-04-01 16:27
Credits
Le Ngoc Anh | Patchstack Bug Bounty Program
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44003",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-18T14:09:46.797099Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-18T14:38:11.814Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "spice-starter-sites",
          "product": "Spice Starter Sites",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "1.2.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Le Ngoc Anh | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:27:35.003Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.\u003cp\u003eThis issue affects Spice Starter Sites: from n/a through \u003c= 1.2.5.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through \u003c= 1.2.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:10:16.157Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/spice-starter-sites/vulnerability/wordpress-spice-starter-sites-plugin-1-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress  Spice Starter Sites plugin \u003c= 1.2.5 - Cross Site Scripting (XSS) vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2024-44003",
    "datePublished": "2024-09-17T23:10:43.499Z",
    "dateReserved": "2024-08-18T21:57:37.334Z",
    "dateUpdated": "2026-04-28T16:10:16.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-5362 (GCVE-0-2023-5362)

Vulnerability from cvelistv5 – Published: 2023-10-30 13:49 – Updated: 2026-04-08 17:19
VLAI?
Title
Carousel, Recent Post Slider and Banner Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Summary
The Carousel, Recent Post Slider and Banner Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'spice_post_slider' shortcode in versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
spicethemes Carousel, Recent Post Slider and Banner Slider Affected: 0 , ≤ 2.0 (semver)
Create a notification for this product.
Credits
István Márton
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:59:43.765Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0dd70b9-6f8a-41fc-ab4f-f6cdfee8dfb8?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/spice-post-slider/tags/1.9/include/view/shortcode.php#L102"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/2981654/spice-post-slider"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/spice-post-slider/tags/2.0.1/include/view/shortcode.php?rev=2981648#L102"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5362",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-05T18:20:51.201805Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-05T18:54:47.364Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Carousel, Recent Post Slider and Banner Slider",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Istv\u00e1n M\u00e1rton"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Carousel, Recent Post Slider and Banner Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027spice_post_slider\u0027 shortcode in versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:19:43.764Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0dd70b9-6f8a-41fc-ab4f-f6cdfee8dfb8?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/spice-post-slider/tags/1.9/include/view/shortcode.php#L102"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/2981654/spice-post-slider"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/spice-post-slider/tags/2.0.1/include/view/shortcode.php?rev=2981648#L102"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-10-03T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2023-10-03T00:00:00.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2023-10-20T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Carousel, Recent Post Slider and Banner Slider \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-5362",
    "datePublished": "2023-10-30T13:49:01.699Z",
    "dateReserved": "2023-10-03T13:34:34.333Z",
    "dateUpdated": "2026-04-08T17:19:43.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}