Skip to content
OpenAdvisories

Vendor

darendev

2 known vulnerabilities.

Products

Simple Theme Changer 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-14391

    Simple Theme Changer <= 1.0 - Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update

    The Simple Theme Changer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's …

    darendev Simple Theme Changer Web / CMS
  • Medium 4.3
    CVE-2025-14392

    Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions

    The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, and set_change_theme_button_name actions actions in all versions up to, and inclu…

    darendev Simple Theme Changer Web / CMS