Approved changes feed: RSS · Atom
cpe:2.3:a:benjaminrojas:wp_editor:*:*:*:*:*:wordpress:*:*part: a version: * update: *
| Vendor | Benjaminrojas (6bc69e4e-b467-55a7-897e-34eb1dcb8201) |
|---|---|
| Product | Wp Editor (37d204db-ab28-5d15-aba3-ede21b24672f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-3295 |
vulnerable | 2026-06-08 07:23:08.600251 |
WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read
MEDIUM (4.9)
The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive information.
Published: 2025-04-17T05:23:19.325Z
Updated: 2026-04-08T16:49:45.110Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3294 |
vulnerable | 2026-06-08 07:23:08.599668 |
WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Update
HIGH (7.2)
The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server.
Published: 2025-04-17T05:23:19.895Z
Updated: 2026-04-08T17:09:29.025Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25591 |
vulnerable | 2026-06-08 06:31:23.319692 |
WordPress WP Editor plugin <=1.2.7 - Sensitive Data Exposure vulnerability
MEDIUM (5.3)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Benjamin Rojas WP Editor.This issue affects WP Editor: from n/a through 1.2.7.
Published: 2024-03-17T16:14:33.113Z
Updated: 2026-04-28T16:09:12.330Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2446 |
vulnerable | 2026-06-08 05:43:35.572285 |
WP Editor <= 1.2.9 - Authenticated (Admin+) PHAR Deserialization
HIGH (7.2)
The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Published: 2024-09-13T15:10:43.938Z
Updated: 2026-04-08T17:32:49.427Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24151 |
vulnerable | 2026-06-08 05:30:03.874049 |
WP Editor < 1.2.7 - Authenticated SQL injection
The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the settings.
Published: 2024-01-16T15:48:54.185Z
Updated: 2025-06-20T16:54:11.018Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-10886 |
vulnerable | 2026-06-08 05:07:25.784830 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-10885 |
vulnerable | 2026-06-08 05:07:25.784481 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.