{"items":[{"id":"CVE-2025-9049","published":"2026-09-05T11:28:48.391Z","updated":"2026-09-07T11:17:23.600Z","title":"Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover","severity":"HIGH","score":8.8,"vendor":"scriptsbundle","product":"Nokri – Job Board WordPress Theme","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2026-18550","published":"2026-09-01T11:31:07.970Z","updated":"2026-09-02T17:58:53.758Z","title":"Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"Nokri – Job Board WordPress Theme","kev":false,"epss":0.00602,"kevAdded":null},{"id":"CVE-2026-66691","published":"2026-08-13T13:37:16.786Z","updated":"2026-08-13T15:21:26.541Z","title":"WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"Nokri","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2025-13851","published":"2026-02-19T04:36:27.334Z","updated":"2026-04-08T17:32:59.618Z","title":"Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"Buyent","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-1729","published":"2026-02-12T01:23:42.939Z","updated":"2026-04-08T16:45:51.879Z","title":"AdForest <= 6.0.12 - Authentication Bypass","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"AdForest","kev":false,"epss":0.00655,"kevAdded":null},{"id":"CVE-2025-69317","published":"2026-01-22T16:52:33.014Z","updated":"2026-04-28T16:14:37.310Z","title":"WordPress CarSpot theme < 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"scriptsbundle","product":"CarSpot","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-67947","published":"2026-01-22T16:51:54.712Z","updated":"2026-04-28T19:27:51.653Z","title":"WordPress AdForest Elementor plugin <= 3.0.11 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"scriptsbundle","product":"AdForest Elementor","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-67946","published":"2026-01-22T16:51:54.507Z","updated":"2026-04-28T19:27:42.343Z","title":"WordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerability","severity":"HIGH","score":8.1,"vendor":"scriptsbundle","product":"AdForest","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2025-67569","published":"2025-12-09T14:14:12.523Z","updated":"2026-04-28T19:23:31.123Z","title":"WordPress AdForest theme <= 6.0.11 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"scriptsbundle","product":"AdForest","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2025-58259","published":"2025-09-22T18:23:22.764Z","updated":"2026-04-28T16:13:43.000Z","title":"WordPress Nokri Theme <= 1.6.4 - Cross Site Request Forgery (CSRF) Vulnerability","severity":"HIGH","score":7.1,"vendor":"scriptsbundle","product":"Nokri","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-8359","published":"2025-09-06T02:24:18.546Z","updated":"2026-04-08T17:19:38.437Z","title":"AdForest <= 6.0.9 - Authentication Bypass to Admin","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"AdForest","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2025-49402","published":"2025-08-28T12:37:14.405Z","updated":"2026-04-28T16:13:03.159Z","title":"WordPress Exertio Framework Plugin <= 1.3.3 - SQL Injection Vulnerability","severity":"HIGH","score":8.5,"vendor":"scriptsbundle","product":"Exertio Framework","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-54686","published":"2025-08-14T10:34:48.233Z","updated":"2026-04-28T16:13:34.984Z","title":"WordPress Exertio Theme <= 1.3.2 - PHP Object Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"Exertio","kev":false,"epss":0.00433,"kevAdded":null},{"id":"CVE-2025-1313","published":"2025-07-12T05:30:11.949Z","updated":"2026-04-08T16:52:21.740Z","title":"Nokri - Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover","severity":"HIGH","score":8.8,"vendor":"scriptsbundle","product":"Nokri – Job Board WordPress Theme","kev":false,"epss":0.00433,"kevAdded":null},{"id":"CVE-2024-12827","published":"2025-06-27T08:23:57.966Z","updated":"2026-04-08T16:52:40.486Z","title":"DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"DWT - Directory & Listing WordPress Theme","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2024-13373","published":"2025-03-01T06:39:27.540Z","updated":"2026-04-08T17:05:30.357Z","title":"Exertio Framework <= 1.3.1 - Unauthenticated Arbitrary User Password Update","severity":"HIGH","score":8.1,"vendor":"scriptsbundle","product":"Exertio Framework","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2024-12824","published":"2025-03-01T06:39:26.867Z","updated":"2026-04-08T16:56:38.735Z","title":"Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"Nokri – Job Board WordPress Theme","kev":false,"epss":0.02389,"kevAdded":null},{"id":"CVE-2024-12860","published":"2025-02-18T08:21:43.498Z","updated":"2026-04-08T17:24:59.674Z","title":"CarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"CarSpot – Dealership Wordpress Classified Theme","kev":false,"epss":0.00492,"kevAdded":null},{"id":"CVE-2025-0169","published":"2025-02-08T22:21:30.776Z","updated":"2026-04-08T17:19:06.626Z","title":"DWT - Directory & Listing WordPress Theme <=3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"MEDIUM","score":6.4,"vendor":"scriptsbundle","product":"DWT - Directory & Listing WordPress Theme","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2024-12857","published":"2025-01-22T07:03:52.415Z","updated":"2026-04-08T16:52:11.854Z","title":"AdForest <= 5.1.8 - Authentication Bypass","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"AdForest","kev":false,"epss":0.00768,"kevAdded":null},{"id":"CVE-2025-0170","published":"2025-01-16T01:49:03.466Z","updated":"2026-04-08T17:26:15.794Z","title":"DWT - Directory & Listing WordPress Theme <= 3.3.3 - Reflected Cross-Site Scripting","severity":"MEDIUM","score":6.1,"vendor":"scriptsbundle","product":"DWT - Directory & Listing WordPress Theme","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2024-12855","published":"2025-01-08T08:18:17.853Z","updated":"2026-04-08T17:27:36.169Z","title":"AdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion","severity":"MEDIUM","score":4.3,"vendor":"scriptsbundle","product":"AdForest","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2024-11350","published":"2025-01-08T08:18:16.723Z","updated":"2026-04-08T16:51:50.893Z","title":"AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"AdForest","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2024-11349","published":"2024-12-21T04:22:17.791Z","updated":"2026-04-08T17:32:53.748Z","title":"AdForest <= 5.1.6 - Authentication Bypass","severity":"CRITICAL","score":9.8,"vendor":"scriptsbundle","product":"AdForest","kev":false,"epss":0.01221,"kevAdded":null}]}