CVE-2025-14469 | Medium | 4.3 | 2026-08-01 | The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce valid… |
CVE-2026-39640 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a throu… |
CVE-2025-68008 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows Reflected XSS.This is… |
CVE-2025-9890 | High | 8.8 | 2025-10-18 | The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrec… |
CVE-2025-58822 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows DOM-Based XSS.This is… |
CVE-2025-23536 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 Track Page Scroll track-page-scroll allows R… |
CVE-2024-37254 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in mndpsingh287 File Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fil… |
CVE-2018-25105 | Critical | 9.8 | 2024-10-16 | The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and… |
CVE-2022-2440 | High | 7.2 | 2024-08-29 | The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to, and including 2.8… |
CVE-2024-3644 | Medium | 4.8 | 2024-05-16 | The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-3643 | High | 8.8 | 2024-05-16 | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform suc… |
CVE-2024-3642 | Medium | 6.9 | 2024-05-16 | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perfo… |
CVE-2024-3641 | Medium | 6.1 | 2024-05-16 | The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Sit… |
CVE-2024-2739 | High | 8.7 | 2024-04-15 | The Advanced Search WordPress plugin through 1.1.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwant… |
CVE-2024-2654 | Medium | 6.8 | 2024-04-09 | The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. Thi… |
CVE-2023-6091 | High | 7.2 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in mndpsingh287 Theme Editor.This issue affects Theme Editor: from n/a through 2.7.1. |
CVE-2024-1538 | High | 8.8 | 2024-03-21 | The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorr… |
CVE-2023-6825 | Critical | 9.9 | 2024-03-13 | The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version)… |
CVE-2024-0761 | High | 8.1 | 2024-02-05 | The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomnes… |