A high-severity Cross-Site Request Forgery (CSRF) vulnerability was discovered in the SpicePress theme, affecting versions from n/a through 2.3.2.5. This issue allows attackers to upload a web shell to a web server, potentially leading to arbitrary plugin installation. The vulnerability has a CVSS score of 8.8 and is classified as HIGH severity. It is tracked under CWE-352. Administrators and users of the [truncated]
The NewsBlogger theme for WordPress has a Cross-Site Request Forgery vulnerability in versions 0.2.5.6 to 0.2.5.9 due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This allows unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request if they can trick a site administrator into performing an action such a [truncated]
