Newscrunch vulnerabilities

2 known vulnerabilities in Newscrunch from Spicethemes. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Newscrunch: Missing Authorization

  CVE-2025-1307Mar 4, 2025SpicethemesEPSS 2.16%

  The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attack

• 8.8 High severity

  Newscrunch: Cross-Site Request Forgery

  CVE-2025-1306Mar 4, 2025Spicethemes

  The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible fo