Read the docs

Themeeditor

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Themeeditor records in CISA KEV

No Themeeditor vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Theme Editor 2 records LOW

Records

2 records

TI-2022-02254 CVE-2022-2440 · GHSA-4mp9-r2w3-x435

Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization

Priority LOW 35

The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to, and including 2.8.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0074 Published 2024-08-29 No fix listed CWE-502
TI-2021-06446 CVE-2021-24154 · GHSA-4cqh-mqrw-7qqg

Theme Editor < 2.6 - Authenticated Arbitrary File Download

Priority LOW 25

The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01066 Published 2021-04-05 Fixed in 2.6 CWE-552
Open these records in search →