WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
newspapers-x
Published
2026-08-28
Title
Newspapers X 1.0.46 - 1.0.48 - Backdoor
Slug
newsup
Published
2025-10-10
Title
Newsup < 5.0.11 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation
Slug
newsxpress
Published
2024-04-10
Title
NewsXpress < 1.0.8 - Cross-Site Request Forgery to Notice Dismissal
Slug
newsy
Published
2025-04-01
Title
Multiple Themify Themes - Reflected Cross-Site Scripting
Slug
newsy
Published
2025-04-01
Title
Multiple Themify Themes - Contributor+ Arbitrary File Upload
Slug
nexio
Published
2026-05-26
Title
Nexio <= 1.10.0 - Unauthenticated Local File Inclusion
Slug
nexos
Published
2019-09-08
Title
Nexos - Real Estate < 1.6.1 - SQL Injection & Persistent XSS
Slug
nexos
Published
2020-06-28
Title
Nexos - Real Estate < 1.8 - Unauthenticated Reflected XSS & SQL Injection
Slug
nexter
Published
2023-10-12
Title
Nexter < 2.0.4 - Authenticated (Subscriber+) SQL Injection via 'to' and 'from'
Slug
nexter
Published
2023-10-12
Title
Nexter < 2.0.4 - Missing Authorization
Slug
ngo-charity-lite
Published
2022-02-14
Title
Multiple Themes - Reflected Cross-Site Scripting via Customizer Notify
Slug
nichebase
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
nichebase
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
nictitate
Published
2024-03-29
Title
Nictitate <= 1.1.4 - Cross-Site Request Forgery
Slug
nifty
Published
2026-06-12
Title
Nifty < 1.4.2 - Unauthenticated PHP Object Injection
Slug
nightlife
Published
2014-08-01
Title
Nightlife by Templatic - CSRF File Upload
Slug
nika
Published
2025-06-11
Title
Nika < 1.2.9 - Unauthenticated Local File Inclusion
Slug
nika
Published
2025-12-23
Title
Nika < 1.2.15 - Authenticated (Contributor+) Local File Inclusion
Slug
nika
Published
2026-02-11
Title
Nika < 1.2.15 - Unauthenticated Local File Inclusion
Slug
nioland
Published
2024-10-22
Title
Nioland < 1.2.7 - Reflected Cross-Site Scripting via s
Slug
nirvana
Published
2024-08-29
Title
Nirvana <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
nirvana
Published
2026-02-26
Title
Nirvana <= 2.6 - Unauthenticated Local File Inclusion
Slug
noisa
Published
2025-07-08
Title
Noisa < 2.6.2 - Authenticated (Subscriber+) PHP Object Injection
Slug
noisa
Published
2025-10-10
Title
Noisa < 2.6.3 - Unauthenticated PHP Object Injection
Slug
nokke
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius