Skip to content
OpenAdvisories

Product · mndpsingh287

Theme Editor

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2025-9890

    Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution

    The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'theme_editor_theme' page. This makes it possible for unauthenticated atta…

    mndpsingh287 Theme Editor Web / CMS
  • High 7.2
    CVE-2022-2440

    Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization

    The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to, and including 2.8. This makes it possible for authenticated attackers with administrative privileges to call files us…

    mndpsingh287 Theme Editor Web / CMS
  • High 7.2
    CVE-2023-6091

    WordPress Theme Editor plugin <= 2.7.1 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in mndpsingh287 Theme Editor.This issue affects Theme Editor: from n/a through 2.7.1.

    mndpsingh287 Theme Editor Web / CMS