14 matches found
CVE-2025-1306
Newscrunch Exploit CVE-2025-1306 šØ Overview This exploit targets a Cross-Site Request Forgery CSRF to Arbitrary File Upload vulnerability CVE-2025-1306 in the Newscrunch WordPress theme. Due to missing nonce validation in the newscrunchinstallandactivateplugin function, an unauthenticated attacke...
CVE-2025-1307
The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunchinstallandactivateplugin function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...
WordPress Newscrunch Theme 1.8.4.1 Shell Upload
WordPress Newscrunch theme version 1.8.4.1 suffers from a remote shell upload vulnerability...
WordPress Newscrunch Theme 1.8.4.1 Cross Site Request Forgery
WordPress Newscrunch theme version 1.8.4 suffers from a cross site request forgery vulnerability...
Exploit for Cross-Site Request Forgery (CSRF) in Spicethemes Newscrunch
Newscrunch Exploit CVE-2025-1306 šØ Overview This explo...
CVE-2025-1307
The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunchinstallandactivateplugin function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...
CVE-2025-1306
The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunchinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...
CVE-2025-1306
The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunchinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...
CVE-2025-1307 Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload
The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunchinstallandactivateplugin function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...
CVE-2025-1306 Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload
The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunchinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...
CVE-2025-1306 Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload
The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunchinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...
CVE-2025-1307: Missing Authorization
The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunchinstallandactivateplugin function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...
PT-2025-9622
Name of the Vulnerable Software and Affected Versions Newscrunch theme for WordPress versions up to, and including, 1.8.4.1 Description The issue is related to a missing capability check in the newscrunch install and activate plugin function, allowing authenticated attackers with Subscriber-level...
WordPress Newscrunch theme <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload vulnerability
Cross-Site Request Forgery to Arbitrary File Upload vulnerability discovered by Gibran Abdillah in WordPress Theme Newscrunch versions = 1.8.4...