WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
nokri
Published
2025-02-28
Title
Nokri < 1.6.3 - Unauthenticated Arbitrary Password Change
Slug
nokri
Published
2025-07-11
Title
Nokri < 1.6.4 - Subscriber+ Privilege Escalation
Slug
nokri
Published
2025-09-22
Title
Nokri <= 1.6.4 - Cross-Site Request Forgery
Slug
nokri
Published
2026-08-10
Title
Nokri – Job Board WordPress Theme < 1.6.7 - Missing Authorization
Slug
nokri
Published
2026-08-31
Title
Nokri - Job Board WordPress Theme < 1.6.7 - Unauthenticated Privilege Escalation via 'token' Parameter
Slug
nokri
Published
2026-09-04
Title
Nokri – Job Board WordPress Theme < 1.6.6 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover
Slug
noo-citilights
Published
2026-02-16
Title
CitiLights < 3.7.2 - Missing Authorization
Slug
noo-citilights
Published
2026-03-16
Title
Support for CitiLights - Real Estate WordPress Theme < 3.7.2 - Reflected Cross-Site Scripting
Slug
noo-citilights
Published
2026-03-16
Title
Support for CitiLights - Real Estate WordPress Theme < 3.7.2 - Authenticated (Subscriber+) PHP Object Injection
Slug
noo-jobmonster
Published
2019-10-24
Title
JobMonster < 4.5.2.9 - Unauthenticated Reflected Cross-Site Scripting
Slug
noo-jobmonster
Published
2020-09-21
Title
JobMonster < 4.6.6.1 - Directory Listing in Upload Folder
Slug
noo-jobmonster
Published
2024-07-09
Title
Jobmonster < 4.7.6 - Unauthenticated Privilege Escalation
Slug
noo-jobmonster
Published
2024-07-09
Title
Jobmonster < 4.7.5 - Unauthenticated Arbitrary File Deletion
Slug
noo-jobmonster
Published
2025-07-23
Title
Jobmonster < 4.7.9 - Reflected Cross-Site Scripting
Slug
noo-jobmonster
Published
2025-08-22
Title
Jobmonster < 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
noo-jobmonster
Published
2025-08-22
Title
Jobmonster < 4.8.1 - Unauthenticated Sensitive Information Disclosure
Slug
noo-jobmonster
Published
2025-08-21
Title
Jobmonster < 4.8.0 - Authentication Bypass
Slug
noo-jobmonster
Published
2025-10-30
Title
Jobmonster < 4.8.2 - Authentication Bypass
Slug
noo-jobmonster
Published
2025-08-31
Title
Jobmonster < 4.7.9 - Reflected Cross-Site Scripting
Slug
noo-jobmonster
Published
2025-12-12
Title
Jobmonster < 4.8.3 - Authenticated (Contributor+) Local File Inclusion
Slug
noo-jobmonster
Published
2026-03-23
Title
Noo JobMonster < 4.8.4 - Unauthenticated SQL Injection
Slug
noo-jobmonster
Published
2026-07-07
Title
Noo JobMonster < 4.8.5.1 - Reflected Cross-Site Scripting
Slug
noo-wemusic
Published
2025-08-02
Title
WeMusic < 1.9.2 - Reflected Cross-Site Scripting
Slug
noo-wemusic
Published
2025-08-02
Title
WeMusic < 1.9.2 - Authenticated (Subscriber+) PHP Object Injection
Slug
noo-yogi
Published
2025-08-02
Title
Yogi - Health Beauty & Yoga < 2.9.3 - Authenticated (Subscriber+) PHP Object Injection