Nootheme
Monthly
Reflected cross-site scripting in the NooTheme Jobmonster WordPress job-board theme (versions up to and including 4.8.5) lets remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because the flaw carries a scope change (S:C), successful exploitation can affect resources beyond the vulnerable component, such as the authenticated WordPress session of an administrator who is lured into clicking. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated attackers can bypass authentication controls in NooTheme Jobica Core through an alternate access path, affecting versions up to 1.4.2. This critical vulnerability (CVSS 9.8) enables attackers to gain unauthorized access without credentials or user interaction. No patch is currently available.
A blind SQL injection vulnerability exists in the NooTheme Jobmonster WordPress theme that allows unauthenticated attackers to execute arbitrary SQL queries against the underlying database. The vulnerability affects Jobmonster versions prior to 4.8.4, and while no active exploitation in the wild has been confirmed via KEV status, the vulnerability was disclosed by Patchstack with sufficient technical detail to enable exploitation. This is a critical web application flaw that could lead to complete database compromise, including extraction of sensitive user data, credentials, and job postings.
A PHP Object Injection vulnerability exists in NooTheme Visionary Core plugin versions up to and including 1.4.9, stemming from unsafe deserialization of untrusted data. An attacker can inject malicious serialized objects to achieve arbitrary code execution or other critical impacts depending on available magic methods in the WordPress environment. No CVSS score, EPSS data, or KEV confirmation is currently available; however, the vulnerability is documented by Patchstack and assigned ENISA EUVD ID EUVD-2026-15602.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme Visionary Core WordPress plugin through version 1.4.9, allowing attackers to inject malicious scripts that execute in users' browsers when they visit crafted URLs. This vulnerability, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), affects all installations of the plugin up to and including version 1.4.9. An attacker can craft a malicious link to steal session cookies, perform unauthorized actions on behalf of logged-in users, or redirect users to phishing sites, with the attack vector being network-based and requiring no authentication.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme Jobica Core plugin through version 1.4.1, allowing attackers to inject malicious scripts into web pages viewed by users. This vulnerability affects the WordPress plugin ecosystem and could enable attackers to steal session cookies, redirect users to phishing sites, or perform actions on behalf of authenticated users. No CVSS score or EPSS data is currently available, and the vulnerability has not been formally added to the CISA Known Exploited Vulnerabilities (KEV) catalog, though active exploitation potential exists given the Reflected XSS attack vector's simplicity.
A PHP Object Injection vulnerability exists in NooTheme Jobica Core plugin through version 1.4.1, stemming from unsafe deserialization of untrusted data. This affects WordPress installations using the vulnerable Jobica Core plugin, allowing attackers to inject malicious serialized objects that can lead to arbitrary code execution or information disclosure depending on available gadget chains. The vulnerability has been identified by Patchstack but lacks public CVSS scoring and KEV confirmation at this time.
A blind SQL injection vulnerability exists in NooTheme's Organici Library WordPress plugin through version 2.1.2, allowing unauthenticated attackers to extract sensitive data from the underlying database without direct error feedback. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements in SQL Commands) and has been documented by Patchstack as a critical WordPress plugin security issue. While no CVSS score, EPSS probability, or public proof-of-concept availability has been confirmed in available sources, the blind SQL injection attack vector and broad plugin distribution make this a medium-to-high priority for WordPress administrators managing affected installations.
A PHP Object Injection vulnerability exists in NooTheme's Organici Library plugin through version 2.1.2, stemming from unsafe deserialization of untrusted data. This vulnerability allows attackers to inject arbitrary PHP objects into the application, potentially leading to remote code execution or other malicious actions depending on available gadget chains in the WordPress environment. No active exploitation in the wild (KEV status) or published proof-of-concept has been confirmed from available sources, but the vulnerability was reported by Patchstack and assigned EUVD-2026-15592, indicating it is tracked in official vulnerability databases.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme's Organici Library plugin for WordPress, affecting versions up to and including 2.1.2. The vulnerability allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users through crafted URLs or form inputs, potentially stealing session cookies, credentials, or performing actions on behalf of victims. While no CVSS score or EPSS data is publicly available, the reflected XSS classification (CWE-79) combined with the lack of apparent access restrictions suggests moderate to high real-world risk, particularly in WordPress environments where plugin vulnerabilities are frequently exploited.
A PHP Object Injection vulnerability exists in NooTheme CitiLights WordPress theme through version 3.7.1, stemming from unsafe deserialization of untrusted data (CWE-502). This allows attackers to inject arbitrary PHP objects, potentially leading to remote code execution or other malicious operations depending on available gadget chains in the WordPress environment. The vulnerability was reported by Patchstack and affects all versions up to and including 3.7.1; no CVSS score, EPSS data, or KEV status is currently available, though the nature of object injection vulnerabilities typically permits unauthenticated exploitation.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme CitiLights WordPress theme versions up to and including 3.7.1, allowing attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper neutralization of user input during web page generation (CWE-79), enabling attackers to execute arbitrary JavaScript in victims' browsers. An attacker can craft malicious URLs containing JavaScript payloads and trick users into clicking them, potentially leading to session hijacking, credential theft, or malware distribution.
In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected cross-site scripting in the NooTheme Jobmonster WordPress job-board theme (versions up to and including 4.8.5) lets remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because the flaw carries a scope change (S:C), successful exploitation can affect resources beyond the vulnerable component, such as the authenticated WordPress session of an administrator who is lured into clicking. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated attackers can bypass authentication controls in NooTheme Jobica Core through an alternate access path, affecting versions up to 1.4.2. This critical vulnerability (CVSS 9.8) enables attackers to gain unauthorized access without credentials or user interaction. No patch is currently available.
A blind SQL injection vulnerability exists in the NooTheme Jobmonster WordPress theme that allows unauthenticated attackers to execute arbitrary SQL queries against the underlying database. The vulnerability affects Jobmonster versions prior to 4.8.4, and while no active exploitation in the wild has been confirmed via KEV status, the vulnerability was disclosed by Patchstack with sufficient technical detail to enable exploitation. This is a critical web application flaw that could lead to complete database compromise, including extraction of sensitive user data, credentials, and job postings.
A PHP Object Injection vulnerability exists in NooTheme Visionary Core plugin versions up to and including 1.4.9, stemming from unsafe deserialization of untrusted data. An attacker can inject malicious serialized objects to achieve arbitrary code execution or other critical impacts depending on available magic methods in the WordPress environment. No CVSS score, EPSS data, or KEV confirmation is currently available; however, the vulnerability is documented by Patchstack and assigned ENISA EUVD ID EUVD-2026-15602.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme Visionary Core WordPress plugin through version 1.4.9, allowing attackers to inject malicious scripts that execute in users' browsers when they visit crafted URLs. This vulnerability, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), affects all installations of the plugin up to and including version 1.4.9. An attacker can craft a malicious link to steal session cookies, perform unauthorized actions on behalf of logged-in users, or redirect users to phishing sites, with the attack vector being network-based and requiring no authentication.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme Jobica Core plugin through version 1.4.1, allowing attackers to inject malicious scripts into web pages viewed by users. This vulnerability affects the WordPress plugin ecosystem and could enable attackers to steal session cookies, redirect users to phishing sites, or perform actions on behalf of authenticated users. No CVSS score or EPSS data is currently available, and the vulnerability has not been formally added to the CISA Known Exploited Vulnerabilities (KEV) catalog, though active exploitation potential exists given the Reflected XSS attack vector's simplicity.
A PHP Object Injection vulnerability exists in NooTheme Jobica Core plugin through version 1.4.1, stemming from unsafe deserialization of untrusted data. This affects WordPress installations using the vulnerable Jobica Core plugin, allowing attackers to inject malicious serialized objects that can lead to arbitrary code execution or information disclosure depending on available gadget chains. The vulnerability has been identified by Patchstack but lacks public CVSS scoring and KEV confirmation at this time.
A blind SQL injection vulnerability exists in NooTheme's Organici Library WordPress plugin through version 2.1.2, allowing unauthenticated attackers to extract sensitive data from the underlying database without direct error feedback. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements in SQL Commands) and has been documented by Patchstack as a critical WordPress plugin security issue. While no CVSS score, EPSS probability, or public proof-of-concept availability has been confirmed in available sources, the blind SQL injection attack vector and broad plugin distribution make this a medium-to-high priority for WordPress administrators managing affected installations.
A PHP Object Injection vulnerability exists in NooTheme's Organici Library plugin through version 2.1.2, stemming from unsafe deserialization of untrusted data. This vulnerability allows attackers to inject arbitrary PHP objects into the application, potentially leading to remote code execution or other malicious actions depending on available gadget chains in the WordPress environment. No active exploitation in the wild (KEV status) or published proof-of-concept has been confirmed from available sources, but the vulnerability was reported by Patchstack and assigned EUVD-2026-15592, indicating it is tracked in official vulnerability databases.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme's Organici Library plugin for WordPress, affecting versions up to and including 2.1.2. The vulnerability allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users through crafted URLs or form inputs, potentially stealing session cookies, credentials, or performing actions on behalf of victims. While no CVSS score or EPSS data is publicly available, the reflected XSS classification (CWE-79) combined with the lack of apparent access restrictions suggests moderate to high real-world risk, particularly in WordPress environments where plugin vulnerabilities are frequently exploited.
A PHP Object Injection vulnerability exists in NooTheme CitiLights WordPress theme through version 3.7.1, stemming from unsafe deserialization of untrusted data (CWE-502). This allows attackers to inject arbitrary PHP objects, potentially leading to remote code execution or other malicious operations depending on available gadget chains in the WordPress environment. The vulnerability was reported by Patchstack and affects all versions up to and including 3.7.1; no CVSS score, EPSS data, or KEV status is currently available, though the nature of object injection vulnerabilities typically permits unauthenticated exploitation.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme CitiLights WordPress theme versions up to and including 3.7.1, allowing attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper neutralization of user input during web page generation (CWE-79), enabling attackers to execute arbitrary JavaScript in victims' browsers. An attacker can craft malicious URLs containing JavaScript payloads and trick users into clicking them, potentially leading to session hijacking, credential theft, or malware distribution.
In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.