# cve.now: Nootheme

The newest entries naming Nootheme as an affected vendor (up to 200), of 32 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-57368](https://cve.now/CVE-2026-57368.md): WordPress Jobmonster theme \<= 4.8.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-27049](https://cve.now/CVE-2026-27049.md): WordPress Jobica Core plugin \<= 1.4.2 - Account Takeover vulnerability (CVSS 9.8)
- [CVE-2026-25340](https://cve.now/CVE-2026-25340.md): WordPress Jobmonster theme \< 4.8.4 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-24981](https://cve.now/CVE-2026-24981.md): WordPress Visionary Core plugin \<= 1.4.9 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-24980](https://cve.now/CVE-2026-24980.md): WordPress Visionary Core plugin \<= 1.4.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-24979](https://cve.now/CVE-2026-24979.md): WordPress Jobica Core plugin \<= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-24978](https://cve.now/CVE-2026-24978.md): WordPress Jobica Core plugin \<= 1.4.1 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-24977](https://cve.now/CVE-2026-24977.md): WordPress Organici Library plugin \<= 2.1.2 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-24976](https://cve.now/CVE-2026-24976.md): WordPress Organici Library plugin \<= 2.1.2 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-24975](https://cve.now/CVE-2026-24975.md): WordPress Organici Library plugin \<= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-24974](https://cve.now/CVE-2026-24974.md): WordPress CitiLights theme \<= 3.7.1 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-24973](https://cve.now/CVE-2026-24973.md): WordPress CitiLights theme \<= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-25367](https://cve.now/CVE-2026-25367.md): WordPress CitiLights theme \< 3.7.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-67524](https://cve.now/CVE-2025-67524.md): WordPress Jobmonster Elementor Addon plugin \<= 1.1.4 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-67522](https://cve.now/CVE-2025-67522.md): WordPress Jobmonster theme \<= 4.8.2 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-11985](https://cve.now/CVE-2025-11985.md): Realty Portal \<= 0.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8)
- [CVE-2025-54737](https://cve.now/CVE-2025-54737.md): WordPress Jobmonster theme \<= 4.7.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-54719](https://cve.now/CVE-2025-54719.md): WordPress Yogi - Health Beauty & Yoga Theme \<= 2.9.2 - Deserialization of untrusted data Vulnerability (CVSS 8.8)
- [CVE-2025-54718](https://cve.now/CVE-2025-54718.md): WordPress Yogi - Health Beauty & Yoga theme \<= 2.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-53586](https://cve.now/CVE-2025-53586.md): WordPress WeMusic Theme \<= 1.9.1 - PHP Object Injection Vulnerability (CVSS 8.8)
- [CVE-2025-53585](https://cve.now/CVE-2025-53585.md): WordPress WeMusic theme \<= 1.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-54738](https://cve.now/CVE-2025-54738.md): WordPress Jobmonster Theme \<= 4.7.9 - Broken Authentication Vulnerability (CVSS 9.8)
- [CVE-2025-57888](https://cve.now/CVE-2025-57888.md): WordPress Jobmonster Theme \<= 4.8.0 - Sensitive Data Exposure Vulnerability (CVSS 5.3)
- [CVE-2025-57887](https://cve.now/CVE-2025-57887.md): WordPress Jobmonster Theme \<= 4.8.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-53201](https://cve.now/CVE-2025-53201.md): WordPress Jobmonster theme \<= 4.7.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-6190](https://cve.now/CVE-2025-6190.md): Realty Portal – Agent \<= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp\_user\_profile() Function (CVSS 8.8)
- [CVE-2025-24779](https://cve.now/CVE-2025-24779.md): WordPress Yogi theme \< 2.9.3 - PHP Object Injection Vulnerability (CVSS 8.8)
- [CVE-2025-3918](https://cve.now/CVE-2025-3918.md): Job Listings 0.1 - 0.1.1 - Unauthenticated Privilege Escalation via register\_action Function (CVSS 9.8)
- [CVE-2024-37928](https://cve.now/CVE-2024-37928.md): WordPress Jobmonster theme \<= 4.7.0 - Unauthenticated Arbitrary File Deletion vulnerability (CVSS 8.6)
- [CVE-2024-37927](https://cve.now/CVE-2024-37927.md): WordPress Jobmonster theme \<= 4.7.5 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2022-45821](https://cve.now/CVE-2022-45821.md): WordPress NOO Timetable Plugin \<= 2.1.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2022-45828](https://cve.now/CVE-2022-45828.md): WordPress NOO Timetable Plugin \<= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nootheme
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.