NewsBlogger

NewsBlogger has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 2 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (67%). Other recurring categories include Missing Authorization.

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

3 independent researchers contributed these findings, one record each. NewsBlogger is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius.

Strategic Overview

Avg CVSSHigh

8.8/ 10

Patch Coverage67%

Open

Fixed

Get automatic notifications for all NewsBlogger vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2025-12821

NewsBlogger <= 0.2.5.6 - 0.2.6.1 - Cross-Site Request Forgery to Arbitrary Plugin Installation

Read the full analysis

Vulnerability Records

3 records


2026-02-18 15:08	NewsBlogger <= 0.2.5.6 - 0.2.6.1 - Cross-Site Request Forgery to Arbitrary Plugin Installation NewsBlogger 0.2.5.6 – 0.2.6.1	`CVE-2025-12821`	8.8 High	lucky_buddy	No
2025-04-30 15:00	NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload NewsBlogger <= 0.2.5.1	`CVE-2025-1304`	8.8 High	CVE_hunter	Yes
2025-04-30 00:00	NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation NewsBlogger <= 0.2.5.4	`CVE-2025-1305`	8.8 High	Gibran Abdillah	Yes

Showing 1–3 of 3 reports

Latestv0.2.6.7

NewsBlogger

Author

spicethemes

5.0(10)

100/100

Last Updated

2026-09-01 (12d ago)

Active Installs

9,000+

Downloads

177,016

Requires WP

5.4+

Requires PHP

5.6+

Created

2024-07-02 (2y ago)

Parent Theme

newscrunch

NewsBlogger is a dynamic and versatile child theme for the popular NewCrunch WordPress theme. Perfect for bloggers, journalists, and online magazines, it offers enhanced customization options, improved performance, and seamless integration with both the Gutenberg and Classic editors. Compatible to various popular plugins such as Elementor, Contact Form 7, Polylang and WPML. Theme is RTL ready and prioritizes user privacy and complies with the General Data Protection Regulation (GDPR) guidelines by refraining from collecting any personal data restricted under GDPR. The theme is also schema-ready, enhancing search engine visibility and optimization. To explore the theme further, feel free to check out our demo at: https://demo-news.spicethemes.com/startersite-1/. For video tutorial visit here https://www.youtube.com/playlist?list=PLTfjrb24Pq_DeJOZdKEaP3rZPbHuOCLtZ