Blazethemes
Monthly
PHP object injection in the BlazeThemes News Kit Elementor Addons plugin for WordPress, affecting versions up to and including 1.5.0, allows an authenticated attacker holding only a subscriber-level account to supply data that the plugin deserializes unsafely, with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicating possible full compromise of confidentiality, integrity and availability of the WordPress site. Exploitation is gated by the low-privilege account requirement, so it is realistically reachable where self-registration is open or where an attacker already holds a subscriber account; no user interaction or elevated role is needed. At time of analysis there is no CISA KEV listing and no public exploit identified, and the actual outcome depends on a usable POP gadget chain being reachable in the plugin or co-installed code, which the available sources do not confirm.
Blind SQL injection in the BlazeThemes Newsmatic theme for WordPress, affecting all versions up to and including 1.5.0, allows unauthenticated remote attackers to append arbitrary SQL into an existing query through the 'slug' parameter and extract sensitive data from the site's database. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) indicates no authentication, user interaction, or non-default configuration is required, but impact is confined to confidentiality - blind data disclosure with no integrity or availability effect. No public exploit code has been identified at time of analysis, and no CISA KEV listing applies; the vendor addressed the flaw in version 1.5.1.
Stored cross-site scripting in the News Kit Addons For Elementor WordPress plugin (all versions up to and including 1.4.8) lets an authenticated attacker with subscriber-level access or above plant arbitrary script inside a post's Elementor data, which executes for any user - typically an administrator or site visitor - who later opens the injected page. This is a genuine but mid-tier priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4) is not unauthenticated, so practical exposure is concentrated on sites that permit self-registration or otherwise hand out low-privileged accounts, and the stored payload only fires when a second party views the affected page. No public exploit identified at time of analysis, and the issue is not in CISA KEV; the decision label from the priority feed is this_month.
Stored Cross-Site Scripting in the News Kit Addons For Elementor WordPress plugin (versions ≤1.4.6) permits authenticated contributors to persistently inject arbitrary JavaScript into pages via the Site Logo Title and Single Author Box widgets by manipulating the elementor_ajax AJAX save request to bypass client-side tag-name restrictions. Every user who subsequently visits an injected page executes the attacker's script in their browser, enabling session hijacking, credential theft, or admin-level actions on their behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in version 1.4.7.
The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render function in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Cross-Site Request Forgery (CSRF) vulnerability in blazethemes Digital Newspaper.1.5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsmatic_filter_posts_load_tab_content'. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PHP object injection in the BlazeThemes News Kit Elementor Addons plugin for WordPress, affecting versions up to and including 1.5.0, allows an authenticated attacker holding only a subscriber-level account to supply data that the plugin deserializes unsafely, with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicating possible full compromise of confidentiality, integrity and availability of the WordPress site. Exploitation is gated by the low-privilege account requirement, so it is realistically reachable where self-registration is open or where an attacker already holds a subscriber account; no user interaction or elevated role is needed. At time of analysis there is no CISA KEV listing and no public exploit identified, and the actual outcome depends on a usable POP gadget chain being reachable in the plugin or co-installed code, which the available sources do not confirm.
Blind SQL injection in the BlazeThemes Newsmatic theme for WordPress, affecting all versions up to and including 1.5.0, allows unauthenticated remote attackers to append arbitrary SQL into an existing query through the 'slug' parameter and extract sensitive data from the site's database. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) indicates no authentication, user interaction, or non-default configuration is required, but impact is confined to confidentiality - blind data disclosure with no integrity or availability effect. No public exploit code has been identified at time of analysis, and no CISA KEV listing applies; the vendor addressed the flaw in version 1.5.1.
Stored cross-site scripting in the News Kit Addons For Elementor WordPress plugin (all versions up to and including 1.4.8) lets an authenticated attacker with subscriber-level access or above plant arbitrary script inside a post's Elementor data, which executes for any user - typically an administrator or site visitor - who later opens the injected page. This is a genuine but mid-tier priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4) is not unauthenticated, so practical exposure is concentrated on sites that permit self-registration or otherwise hand out low-privileged accounts, and the stored payload only fires when a second party views the affected page. No public exploit identified at time of analysis, and the issue is not in CISA KEV; the decision label from the priority feed is this_month.
Stored Cross-Site Scripting in the News Kit Addons For Elementor WordPress plugin (versions ≤1.4.6) permits authenticated contributors to persistently inject arbitrary JavaScript into pages via the Site Logo Title and Single Author Box widgets by manipulating the elementor_ajax AJAX save request to bypass client-side tag-name restrictions. Every user who subsequently visits an injected page executes the attacker's script in their browser, enabling session hijacking, credential theft, or admin-level actions on their behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in version 1.4.7.
The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render function in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Cross-Site Request Forgery (CSRF) vulnerability in blazethemes Digital Newspaper.1.5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsmatic_filter_posts_load_tab_content'. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.