Mndpsingh287 vulnerabilities
Published CVEs affecting Mndpsingh287 products: 4 record(s), with severity, exploitation and fixes.
CVE-2025-14469
Medium · 4.3
CWE-352 Aug 1, 2026
Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the ms_update AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
CVE-2026-39640
Critical · 9.6
CWE-352 Apr 8, 2026
Theme Editor WordPress Plugin: CSRF Leading to Code Injection
Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a through <= 3.2.
CVE-2025-68008
High · 7.1
CWE-79 Jan 22, 2026
WordPress WP Mail plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows Reflected XSS.This issue affects WP Mail: from n/a through <= 1.3.
CVE-2025-9890
High · 8.8
CWE-352 Oct 18, 2025
Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'theme_editor_theme' page. This makes it possible for unauthenticated attackers to achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.