nsthemes vulnerabilities

Products

• Advanced Social Pixel 1
• NS Coupon To Become Customer 1
• NS Ie Compatibility Fixer 1
• NS Product icon badge 1
• NS Simple Intro Loader 1
• ns watermark for woocommerce 1

Latest nsthemes CVEs

Newest publication first

1. CVE-2026-8707 NS Product icon badge <= 1.2.4 - Reflected Cross-Site Scripting via PHP_SELF

   Published 2026-05-27

   Medium·CVSS 6.1 EPSS 0.21%

   The NS Product icon badge plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbit...

2. CVE-2025-14845 NS IE Compatibility Fixer <= 2.1.5 - Cross-Site Request Forgery to Plugin Settings Update

   Published 2026-01-07

   Medium·CVSS 4.3 EPSS 0.16%

   The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.1.5. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to...

3. CVE-2025-23459 WordPress NS Simple Intro Loader plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-03-26

   High·CVSS 7.1 EPSS 0.37%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NsThemes NS Simple Intro Loader ns-simple-intro-loader allows Reflected XSS.This issue affects NS Simple Intro Loader: from n/a through <= 2.2.3.

4. CVE-2023-27422 WordPress NS Coupon to Become Customer Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-08-08

   Medium·CVSS 4.8 EPSS 0.37%

   Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NsThemes NS Coupon To Become Customer plugin <= 1.2.2 versions.

5. CVE-2023-24381 WordPress Advanced Social Pixel Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-03-20

   Medium·CVSS 4.8 EPSS 0.39%

   Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NsThemes Advanced Social Pixel plugin <= 2.1.1 versions.

6. CVE-2022-0989 NS WooCommerce Watermark <= 2.11.3 - Abuse of Functionality

   Published 2022-04-11

   High·CVSS 7.5 EPSS 1.2%

   An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide malware for example from passing malicious domains to hide their trace, by making them pass through the vulnerable domain.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.