Newsmatic
Monthly
Blind SQL injection in the BlazeThemes Newsmatic theme for WordPress, affecting all versions up to and including 1.5.0, allows unauthenticated remote attackers to append arbitrary SQL into an existing query through the 'slug' parameter and extract sensitive data from the site's database. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) indicates no authentication, user interaction, or non-default configuration is required, but impact is confined to confidentiality - blind data disclosure with no integrity or availability effect. No public exploit code has been identified at time of analysis, and no CISA KEV listing applies; the vendor addressed the flaw in version 1.5.1.
The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsmatic_filter_posts_load_tab_content'. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Blind SQL injection in the BlazeThemes Newsmatic theme for WordPress, affecting all versions up to and including 1.5.0, allows unauthenticated remote attackers to append arbitrary SQL into an existing query through the 'slug' parameter and extract sensitive data from the site's database. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) indicates no authentication, user interaction, or non-default configuration is required, but impact is confined to confidentiality - blind data disclosure with no integrity or availability effect. No public exploit code has been identified at time of analysis, and no CISA KEV listing applies; the vendor addressed the flaw in version 1.5.1.
The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsmatic_filter_posts_load_tab_content'. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.