nootheme vulnerabilities and threats

29 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.1	EPSS 0.3%	CVE-2026-57368Jobmonster (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.3%2026-07-13CVE Database V5CVE-2026-57368 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.8.5. EPSS 0.3%Vulnerability NooTheme CWE-79	CVE Database V5	2026-07-13
Critical	9.8	EPSS 0.5%	CVE-2026-27049Jobica Core (WordPress plugin) · Authentication Bypass Using an Alternate Path or Channel Critical9.8EPSS 0.5%2026-03-25CVE Database V5CVE-2026-27049 Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobica Core: from n/a through <= 1.4.2. EPSS 0.5%Vulnerability NooTheme	CVE Database V5	2026-03-25
Critical	9.3	EPSS 0.3%	CVE-2026-25340Jobmonster (WordPress plugin) · SQL Injection Critical9.3EPSS 0.3%2026-03-25CVE Database V5CVE-2026-25340 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Jobmonster noo-jobmonster allows Blind SQL Injection.This issue affects Jobmonster: from n/a through < 4.8.4. EPSS 0.3%Vulnerability NooTheme	CVE Database V5	2026-03-25
High	8.8	EPSS 0.4%	CVE-2026-24981Visionary Core (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.4%2026-03-25CVE Database V5CVE-2026-24981 Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9. EPSS 0.4%Vulnerability NooTheme	CVE Database V5	2026-03-25
High	7.1	EPSS 0.2%	CVE-2026-24980Visionary Core (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-03-25CVE Database V5CVE-2026-24980 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Visionary Core noo-visionary-core allows Reflected XSS.This issue affects Visionary Core: from n/a through <= 1.4.9. EPSS 0.2%Vulnerability NooTheme	CVE Database V5	2026-03-25
High	7.1	EPSS 0.2%	CVE-2026-24979Jobica Core (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-03-25CVE Database V5CVE-2026-24979 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobica Core jobica-core allows Reflected XSS.This issue affects Jobica Core: from n/a through <= 1.4.1. EPSS 0.2%Vulnerability NooTheme	CVE Database V5	2026-03-25
High	8.8	EPSS 0.4%	CVE-2026-24978Jobica Core (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.4%2026-03-25CVE Database V5CVE-2026-24978 Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1. EPSS 0.4%Vulnerability NooTheme	CVE Database V5	2026-03-25
High	8.5	EPSS 0.3%	CVE-2026-24977Organici Library (WordPress plugin) · SQL Injection High8.5EPSS 0.3%2026-03-25CVE Database V5CVE-2026-24977 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Organici Library noo-organici-library allows Blind SQL Injection.This issue affects Organici Library: from n/a through <= 2.1.2. EPSS 0.3%Vulnerability NooTheme	CVE Database V5	2026-03-25
High	8.8	EPSS 0.4%	CVE-2026-24976Organici Library (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.4%2026-03-25CVE Database V5CVE-2026-24976 Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library: from n/a through <= 2.1.2. EPSS 0.4%Vulnerability NooTheme	CVE Database V5	2026-03-25
High	7.1	EPSS 0.2%	CVE-2026-24975Organici Library (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-03-25CVE Database V5CVE-2026-24975 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Organici Library noo-organici-library allows Reflected XSS.This issue affects Organici Library: from n/a through <= 2.1.2. EPSS 0.2%Vulnerability NooTheme	CVE Database V5	2026-03-25
High	8.8	EPSS 0.4%	CVE-2026-24974CitiLights (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.4%2026-03-25CVE Database V5CVE-2026-24974 Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1. EPSS 0.4%Vulnerability NooTheme	CVE Database V5	2026-03-25
High	7.1	EPSS 0.2%	CVE-2026-24973CitiLights (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-03-25CVE Database V5CVE-2026-24973 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme CitiLights noo-citilights allows Reflected XSS.This issue affects CitiLights: from n/a through <= 3.7.1. EPSS 0.2%Vulnerability NooTheme	CVE Database V5	2026-03-25
Medium	5.3	EPSS 0.3%	CVE-2026-25367CitiLights (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.3%2026-02-19CVE Database V5CVE-2026-25367 Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through < 3.7.2. EPSS 0.3%Vulnerability NooTheme	CVE Database V5	2026-02-19
High	7.5	EPSS 0.4%	CVE-2025-67524Jobmonster Elementor Addon (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High7.5EPSS 0.4%2025-12-09CVE Database V5CVE-2025-67524 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NooTheme Jobmonster Elementor Addon jobmonster-addon allows PHP Local File Inclusion.This issue affects Jobmonster Elementor Addon: from n/a through <= 1.1.4. EPSS 0.4%Vulnerability NooTheme CWE-98	CVE Database V5	2025-12-09
High	7.5	EPSS 0.4%	CVE-2025-67522Jobmonster (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High7.5EPSS 0.4%2025-12-09CVE Database V5CVE-2025-67522 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NooTheme Jobmonster noo-jobmonster allows PHP Local File Inclusion.This issue affects Jobmonster: from n/a through <= 4.8.2. EPSS 0.4%Vulnerability NooTheme CWE-98	CVE Database V5	2025-12-09
High	8.8	EPSS 0.4%	CVE-2025-11985Realty Portal (WordPress plugin) · Missing Authorization High8.8EPSS 0.4%2025-11-21CVE Database V5CVE-2025-11985 The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'rp_save_property_settings' function in versions 0.1 to 0.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. EPSS 0.4%Vulnerability nootheme CWE-862	CVE Database V5	2025-11-21
High	7.1	EPSS 0.2%	CVE-2025-54737Jobmonster (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2025-11-06CVE Database V5CVE-2025-54737 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.7.8. EPSS 0.2%Vulnerability NooTheme	CVE Database V5	2025-11-06
High	8.8	EPSS 0.4%	CVE-2025-54719Yogi (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.4%2025-11-06CVE Database V5CVE-2025-54719 Deserialization of Untrusted Data vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Object Injection.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2. EPSS 0.4%Vulnerability NooTheme	CVE Database V5	2025-11-06
High	7.1	EPSS 0.2%	CVE-2025-54718Yogi (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2025-11-06CVE Database V5CVE-2025-54718 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Reflected XSS.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2. EPSS 0.2%Vulnerability NooTheme	CVE Database V5	2025-11-06
High	8.8	EPSS 0.5%	CVE-2025-53586WeMusic (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.5%2025-11-06CVE Database V5CVE-2025-53586 Deserialization of Untrusted Data vulnerability in NooTheme WeMusic noo-wemusic allows Object Injection.This issue affects WeMusic: from n/a through <= 1.9.1. EPSS 0.5%Vulnerability NooTheme CWE-502	CVE Database V5	2025-11-06

Page 1 of 2