Vulnerabilidades de Mndpsingh287
CVEs publicadas que afetam produtos de Mndpsingh287: 3 registro(s), com severidade, exploração e correções.
CVE-2026-39640
Crítica · 9.6
CWE-352 08/04/2026
Plugin WordPress Theme Editor: CSRF com injeção de código
Vulnerabilidade de Cross-Site Request Forgery (CSRF) em mndpsingh287 Theme Editor theme-editor permite Injeção de Código.Este problema afeta o Theme Editor: de n/a até <= 3.2.
CVE-2025-68008
Alta · 7.1
CWE-79 22/01/2026
WordPress WP Mail plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows Reflected XSS.This issue affects WP Mail: from n/a through <= 1.3.
CVE-2025-9890
Alta · 8.8
CWE-352 18/10/2025
Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'theme_editor_theme' page. This makes it possible for unauthenticated attackers to achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.