SpabRice vulnerabilities

Products

• Mogi 1
• Nyla 1
• Pond 1
• Vavo Core 1

Latest SpabRice CVEs

Newest publication first

1. CVE-2026-94066 WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-10-09

   High·CVSS 7.1 EPSS 0.15%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1.

2. CVE-2026-28570 WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability

   Published 2026-08-18

   High·CVSS 8.1 EPSS 0.47%

   Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.

3. CVE-2026-39642 WordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability

   Published 2026-05-26

   Medium·CVSS 5.3 EPSS 0.26%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection. This issue affects Nyla: from n/a through 1.7.

4. CVE-2026-39637 WordPress Mogi theme <= 1.2.3 - Arbitrary Shortcode Execution vulnerability

   Published 2026-04-08

   Medium·CVSS 5.3 EPSS 0.24%

   Missing Authorization vulnerability in SpabRice Mogi mogi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mogi: from n/a through <= 1.2.3.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.