blazethemes has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 7.5 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Products
- News Kit Addons For Elementor 1
- Newsmatic 1
- news-kit-elementor-addons 1
Worst active — by depth score
CVE-2026-118073High· 8.8WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability48CVE-2026-110184High· 7.5Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter41CVE-2026-120524Medium· 6.4News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action35
blazethemes vulnerabilities
CVEs affecting blazethemes, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-120524Medium· 6.4News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action
The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This…
CVE-2026-118073High· 8.8WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
CVE-2026-110184High· 7.5Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter
The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…