Mndpsingh287 Theme Editor vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Mndpsingh287 Theme Editor: 3 record(s), with affected versions and fixes.

CVE-2025-14469 Medium · 4.3 CWE-352 Aug 1, 2026

Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the ms_update AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged request granted they can trick an administrator into performing an action such as clicking on a link.

CVE-2026-39640 Critical · 9.6 CWE-352 Apr 8, 2026

Theme Editor WordPress Plugin: CSRF Leading to Code Injection

Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a through <= 3.2.

CVE-2025-9890 High · 8.8 CWE-352 Oct 18, 2025

Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'theme_editor_theme' page. This makes it possible for unauthenticated attackers to achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.