nK vulnerabilities

Products

• Ghost Kit 2
• DocsPress 1
• Lazy Blocks 1
• nK Themes Helper 1
• Visual Portfolio, Photo Gallery & Post Grid 1

Latest nK CVEs

Newest publication first

1. CVE-2026-57651 WordPress Ghost Kit plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-06-26

   Medium·CVSS 6.5 EPSS 0.22%

   Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.

2. CVE-2026-32537 WordPress Visual Portfolio, Photo Gallery & Post Grid plugin <= 3.5.1 - Local File Inclusion vulnerability

   Published 2026-03-25

   High·CVSS 7.5 EPSS 0.32%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Portfolio, Photo Gallery & Post Grid:...

3. CVE-2025-22726 WordPress nK Themes Helper plugin <= 1.7.9 - Server Side Request Forgery (SSRF) vulnerability

   Published 2026-01-08

   Medium·CVSS 6.4 EPSS 0.24%

   Server-Side Request Forgery (SSRF) vulnerability in _nK nK Themes Helper nk-themes-helper allows Server Side Request Forgery.This issue affects nK Themes Helper: from n/a through <= 1.7.9.

4. CVE-2025-58258 WordPress Lazy Blocks Plugin <= 4.1.0 - Broken Access Control Vulnerability

   Published 2025-09-22

   Medium·CVSS 4.3 EPSS 0.26%

   Missing Authorization vulnerability in nK Lazy Blocks lazy-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lazy Blocks: from n/a through <= 4.1.0.

5. CVE-2025-53567 WordPress Ghost Kit <= 3.4.1 - Local File Inclusion Vulnerability

   Published 2025-08-20

   High·CVSS 8.1 EPSS 0.62%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Ghost Kit ghostkit allows PHP Local File Inclusion.This issue affects Ghost Kit: from n/a through <= 3.4.1.

6. CVE-2025-49240 WordPress DocsPress plugin <= 2.5.2 - Broken Access Control Vulnerability

   Published 2025-06-06

   Medium·CVSS 4.3 EPSS 0.31%

   Missing Authorization vulnerability in nK DocsPress docspress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DocsPress: from n/a through <= 2.5.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.