NewsBlogger vulnerabilities

3 known vulnerabilities in NewsBlogger from Spicethemes. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  NewsBlogger: Cross-Site Request Forgery

  CVE-2025-12821Feb 19, 2026Spicethemes

  The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.5.9. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthent

• 8.8 High severity

  NewsBlogger: Cross-Site Request Forgery

  CVE-2025-1305May 1, 2025Spicethemes

  The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possibl

• 8.8 High severity

  NewsBlogger: Missing Authorization

  CVE-2025-1304May 1, 2025SpicethemesEPSS 1.16%

  The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated atta