scriptsbundle vulnerabilities

Products

• AdForest 1
• carspot 1
• Exertio 1
• Nokri 1
• Nokri – Job Board WordPress Theme 1

Latest scriptsbundle CVEs

Newest publication first

1. CVE-2026-18550 Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter

   Published 2026-09-01

   Critical·CVSS 9.8

   The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokri_reset_password() function, which allows empty attacker-suppl...

2. CVE-2026-66691 WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability

   Published 2026-08-13

   Critical·CVSS 9.8

   Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.

3. CVE-2026-1729 AdForest <= 6.0.12 - Authentication Bypass

   Published 2026-02-12

   Critical·CVSS 9.8

   The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the 'sb_login_user_with_otp_fun' function. This makes it p...

4. CVE-2025-54686 WordPress Exertio Theme <= 1.3.2 - PHP Object Injection Vulnerability

   Published 2025-08-14

   Critical·CVSS 9.8

   Deserialization of Untrusted Data vulnerability in scriptsbundle Exertio exertio allows Object Injection.This issue affects Exertio: from n/a through <= 1.3.2.

5. CVE-2019-15870 CarSpot – Dealership Wordpress Classified Theme < 2.1.7 - Authenticated Stored Cross-Site Scripting

   Published 2019-09-03

   Medium·CVSS 5.4

   The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.