Scriptsbundle develops a small portfolio of web-based applications including AdForest, CarSpot, and DWT Listing, marketed toward classified listing and marketplace operators; vulnerabilities affecting these products skew strongly toward critical severity and concentrate in authentication and input-handling weaknesses such as authentication bypass via alternate channels, missing authentication for critical functions, missing authorization checks, cross-site scripting, and weak password recovery mechanisms. These are structural flaws endemic to web applications with insufficient access control and sanitization discipline, and they recur across the vendor's product line. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Scriptsbundle over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-12857CRITICAL The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's ident | Jan 22, 2025 | 9.8 | 29 | NO | NO |
CVE-2024-11349CRITICAL The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly verifying a user's ident | Dec 21, 2024 | 9.8 | 28 | NO | NO |
CVE-2024-11350CRITICAL The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plugin not properly vali | Jan 8, 2025 | 9.8 | 27 | NO | NO |
CVE-2025-69317HIGH Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle CarSpot carspot allows Reflected XSS.This issue affects CarSpot: | Jan 22, 2026 | 7.1 | 26 | NO | NO |
CVE-2019-15870MEDIUM The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field. | Sep 3, 2019 | 5.4 | 19 | NO | NO |
CVE-2025-0169MEDIUM The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insufficient input sanitiza | Feb 8, 2025 | 5.4 | 18 | NO | NO |
CVE-2024-12855MEDIUM The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sb_remove_ad' in all versions up | Jan 8, 2025 | 5.4 | 17 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Scriptsbundle.
Media articles that mention a CVE ID that affects a product developed by Scriptsbundle — matched by CVE ID, not by vendor name.