Extension WordPress
Vulnérabilités WP Editor
Cette page rassemble les failles publiées pour WP Editor, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de WP Editor
10 fiches
WP Editor <= 1.2.9.2 – Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor
The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for…
*-1.2.9.2
1.2.9.3
30/04/2026
WP Editor <= 1.2.9.1 – Authenticated (Administrator+) Directory Traversal to Arbitrary File Read
The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the…
*-1.2.9.1
1.2.9.2
16/04/2025
WP Editor <= 1.2.9.1 – Authenticated (Administrator+) Directory Traversal to Arbitrary File Update
The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above,…
*-1.2.9.1
1.2.9.2
16/04/2025
WP Editor <= 1.2.9 – Authenticated (Admin+) PHAR Deserialization
The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative privileges to call files using…
*-1.2.9
1.2.9.1
12/09/2024
WP Editor <= 1.2.8 – Reflected Cross-Site Scripting
The WP Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
*-1.2.8
1.2.9
26/03/2024
WP Editor <= 1.2.7 – Sensitive Information Exposure via log file
The WP Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.7 via the plugin's log file. This makes it possible for unauthenticated attackers to extract sensitive data including configuration…
*-1.2.7
1.2.8
12/02/2024
WP Editor <= 1.2.6.3 – Authenticated (Admin+) SQL injection
The WP Editor plugin for WordPress is vulnerable to blind SQL Injection via the setting fields in versions up to, and including, 1.2.6.3 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the…
*-1.2.6.3
1.2.7
01/02/2021
WP Editor < 1.2.6 – Incorrect Permission Assignment or Protection
The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
[*, 1.2.6)
1.2.6
15/01/2021
WP Editor <= 1.2.6.2 – Cross-Site Scripting
The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.
[*, 1.2.6.3)
1.2.6.3
05/10/2016
WP Editor < 1.2.6 – Cross-Site Request Forgery
The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 1.2.6. This is due to missing or incorrect nonce validation on the save_settings() function, in addition to a few other functions. This…
[*, 1.2.6)
1.2.6
13/05/2016
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.