Vulnerabilities

TI-2025-02882 CVE-2025-3294 · GHSA-xp8f-rxxq-p5wv

WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Update

LOW 36

The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01037 Published 2025-04-17 No fix listed CWE-22

TI-2025-02883 CVE-2025-3295 · GHSA-p5jf-h6mx-5w8x

WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read

LOW 23

The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00538 Published 2025-04-17 No fix listed CWE-22

TI-2022-02259 CVE-2022-2446 · GHSA-gm45-ppxv-rfjp

WP Editor <= 1.2.9 - Authenticated (Admin+) PHAR Deserialization

LOW 34

The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up to, and including 1.2.9.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00578 Published 2024-09-13 No fix listed CWE-502

TI-2024-16819 CVE-2024-25591 · GHSA-jcqm-fhp5-5j5j

WordPress WP Editor plugin <=1.2.7 - Sensitive Data Exposure vulnerability

LOW 33

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Benjamin Rojas WP Editor.This issue affects WP Editor: from n/a through 1.2.7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00453 Published 2024-03-17 No fix listed CWE-200

TI-2021-06443 CVE-2021-24151 · GHSA-85ff-hfw5-g96g

WP Editor < 1.2.7 - Authenticated SQL injection

LOW 33

The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the sett…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00771 Published 2024-01-16 Fixed in 1.2.7 CWE-89

TI-2016-08923 CVE-2016-10885 · GHSA-g7vh-w82q-6c7j

The wp-editor plugin before 1.2.6 for WordPress has CSRF.

LOW 39

The wp-editor plugin before 1.2.6 for WordPress has CSRF.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0068 Published 2019-08-14 No fix listed CWE-352

TI-2016-08924 CVE-2016-10886 · GHSA-hf4m-wpq9-6c3x

The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.

MEDIUM 46

The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01999 Published 2019-08-14 No fix listed CWE-264

Vulnerabilities

Filters

WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Update

WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read

WP Editor <= 1.2.9 - Authenticated (Admin+) PHAR Deserialization

WordPress WP Editor plugin <=1.2.7 - Sensitive Data Exposure vulnerability

WP Editor < 1.2.7 - Authenticated SQL injection

The wp-editor plugin before 1.2.6 for WordPress has CSRF.

The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.