Vulnerabilidades do Mndpsingh287 Theme Editor
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Mndpsingh287 Theme Editor: 2 registro(s), com versões afetadas e correções.
CVE-2026-39640
Crítica · 9.6
CWE-352 08/04/2026
Plugin WordPress Theme Editor: CSRF com injeção de código
Vulnerabilidade de Cross-Site Request Forgery (CSRF) em mndpsingh287 Theme Editor theme-editor permite Injeção de Código.Este problema afeta o Theme Editor: de n/a até <= 3.2.
CVE-2025-9890
Alta · 8.8
CWE-352 18/10/2025
Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'theme_editor_theme' page. This makes it possible for unauthenticated attackers to achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.