CVEs we hold for Nootheme
Records whose assigning authority named Nootheme as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-57368WordPress Jobmonster theme <= 4.8.5 - Reflected Cross Site Scripting (XSS) vulnerabilityNooTheme Jobmonster
CVE-2026-27049WordPress Jobica Core plugin <= 1.4.2 - Account Takeover vulnerabilityNooTheme Jobica Core
CVE-2026-25367WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerabilityNooTheme CitiLights
CVE-2026-24981WordPress Visionary Core plugin <= 1.4.9 - PHP Object Injection vulnerabilityNooTheme Visionary Core
CVE-2026-24980WordPress Visionary Core plugin <= 1.4.9 - Reflected Cross Site Scripting (XSS) vulnerabilityNooTheme Visionary Core
CVE-2026-24979WordPress Jobica Core plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityNooTheme Jobica Core
CVE-2026-24978WordPress Jobica Core plugin <= 1.4.1 - PHP Object Injection vulnerabilityNooTheme Jobica Core
CVE-2026-24977WordPress Organici Library plugin <= 2.1.2 - SQL Injection vulnerabilityNooTheme Organici Library
CVE-2026-24976WordPress Organici Library plugin <= 2.1.2 - PHP Object Injection vulnerabilityNooTheme Organici Library
CVE-2026-24975WordPress Organici Library plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityNooTheme Organici Library
CVE-2026-24974WordPress CitiLights theme <= 3.7.1 - PHP Object Injection vulnerabilityNooTheme CitiLights
CVE-2026-24973WordPress CitiLights theme <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityNooTheme CitiLights
CVE-2025-67524WordPress Jobmonster Elementor Addon plugin <= 1.1.4 - Local File Inclusion vulnerabilityNooTheme Jobmonster Elementor Addon
CVE-2025-67522WordPress Jobmonster theme <= 4.8.2 - Local File Inclusion vulnerabilityNooTheme Jobmonster
CVE-2025-6190Realty Portal – Agent <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via…nootheme Realty Portal – Agent
CVE-2025-57888WordPress Jobmonster Theme <= 4.8.0 - Sensitive Data Exposure VulnerabilityNooTheme Jobmonster
CVE-2025-57887WordPress Jobmonster Theme <= 4.8.0 - Cross Site Scripting (XSS) VulnerabilityNooTheme Jobmonster
CVE-2025-54738WordPress Jobmonster Theme <= 4.7.9 - Broken Authentication VulnerabilityNooTheme Jobmonster
CVE-2025-54737WordPress Jobmonster theme <= 4.7.8 - Cross Site Scripting (XSS) vulnerabilityNooTheme Jobmonster
CVE-2025-54719WordPress Yogi - Health Beauty & Yoga Theme <= 2.9.2 - Deserialization of untrusted data VulnerabilityNooTheme Yogi - Health Beauty & Yoga
CVE-2025-54718WordPress Yogi - Health Beauty & Yoga theme <= 2.9.2 - Cross Site Scripting (XSS) vulnerabilityNooTheme Yogi - Health Beauty & Yoga
CVE-2025-53585WordPress WeMusic theme <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilityNooTheme WeMusic
CVE-2025-53201WordPress Jobmonster theme <= 4.7.8 - Cross Site Scripting (XSS) vulnerabilityNooTheme Jobmonster
CVE-2025-3918Job Listings 0.1 - 0.1.1 - Unauthenticated Privilege Escalation via register_action Functionnootheme Job Listings
CVE-2025-11985Realty Portal <= 0.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Updatenootheme Realty Portal
CVE-2024-37928WordPress Jobmonster theme <= 4.7.0 - Unauthenticated Arbitrary File Deletion vulnerabilityNooTheme Jobmonster
CVE-2024-37927WordPress Jobmonster theme <= 4.7.5 - Unauthenticated Privilege Escalation vulnerabilityNooTheme Jobmonster
CVE-2022-45828WordPress NOO Timetable Plugin <= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF)NooTheme Noo Timetable
CVE-2022-45821WordPress NOO Timetable Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS)NooTheme Noo Timetable
32 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.