Each version is cleaned, compared against the vendor’s license code and scanned before it is committed. A version that does not pass is not published. Last scan .
6 known vulnerabilities affect 1.5.6, the latest version in the repository.
See known vulnerabilities
Published versions1
Files scanned857
Findings reviewed6
Versions held back4
Held back: archives of this theme that did not pass the automatic checks and are not published. Findings reviewed: matches of the rules that were checked and resolved before publication.
Reporting a vulnerability. Security problems in the theme’s own code belong to the vendor, Scripts Bundle; report them there. Problems with a package as this repository distributes it — a file that should not be there, a scan that missed something — go to packages@meteorgpl.com, and are answered within 48 hours.
What happens on a finding. The affected versions are withdrawn from the repository, watchers of the package are notified, and a corrected version is published when one passes every check.
Rights holders. The takedown policy describes how a package is removed.
Known vulnerabilities
Public vulnerability reports for Nokri, the versions they affect and the version in this repository that fixes them. Watchers and accounts known to run an affected version are alerted.
The vendor fixed it in 1.6.6; that version is not in the repository yet.
1 version in this repository is affected: 1.5.6
Details
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.
Remediation: Update to version 1.6.6, or a newer patched version
The vendor fixed it in 1.6.7; that version is not in the repository yet.
1 version in this repository is affected: 1.5.6
Details
The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the `nokri_reset_password()` function, which allows empty attacker-supplied reset tokens to match empty or unset `sb_password_forget_token` user meta values. This makes it possible for unauthenticated attackers to reset the password of any user, including administrators, and gain access to their account.
Remediation: Update to version 1.6.7, or a newer patched version
The vendor fixed it in 1.6.7; that version is not in the repository yet.
1 version in this repository is affected: 1.5.6
Details
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Remediation: Update to version 1.6.7, or a newer patched version
The Nokri theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Remediation: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
The vendor fixed it in 1.6.4; that version is not in the repository yet.
1 version in this repository is affected: 1.5.6
Details
The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email address. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Remediation: Update to version 1.6.4, or a newer patched version
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The vendor fixed it in 1.6.3; that version is not in the repository yet.
1 version in this repository is affected: 1.5.6
Details
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and leverage that to gain access to their account.
Remediation: Update to version 1.6.3, or a newer patched version
Copyright 2012-2026 Defiant Inc.. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. https://www.cve.org/Legal/TermsOfUse
