SpabRice vulnerabilities

🔔 Create alert RSS

Published CVEs affecting SpabRice products: 3 record(s), with severity, exploitation and fixes.

Pond 1 Mogi 1 Nyla 1

Exploited only (KEV) →

CVE-2026-94066 High · 7.1 CWE-79 Oct 9, 2026

WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1.

CVE-2026-39642 Medium · 5.3 CWE-80 May 26, 2026

WordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection. This issue affects Nyla: from n/a through 1.7.

CVE-2026-39637 Medium · 5.3 CWE-862 Apr 8, 2026

WordPress Mogi theme <= 1.2.3 - Arbitrary Shortcode Execution vulnerability

Missing Authorization vulnerability in SpabRice Mogi mogi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mogi: from n/a through <= 1.2.3.