CVE-2025-9890 Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'themeeditortheme' page. This makes it possible for unauthenticated attackers to achieve remote code execution v...

CVE-2025-9890

The CVE-2025-9890 entry concerns the WordPress Theme Editor plugin (affected: WordPress Theme Editor) with a Cross-Site Request Forgery (CSRF) to Remote Code Execution vulnerability affecting all versions up to 3.0. The issue arises from missing/incorrect nonce validation on the theme_editor_them...

WordPress Theme Editor plugin <= 3.0 - Cross-Site Request Forgery to Remote Code Execution vulnerability

Cross-Site Request Forgery to Remote Code Execution vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Theme Editor versions = 3.0...

CVE-2025-57567

A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory /themes/defaut/css/minify.php. An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel,...

WordPress plugin Theme Editor 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

UBUNTU-CVE-2025-57567

A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory /themes/defaut/css/minify.php. An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel,...

CVE-2025-57567

The CVE-2025-57567 entry concerns PluXml CMS. A vulnerability in the default theme’s minify.php (path: /themes/defaut/css/minify.php) can be triggered by an authenticated administrator who overwrites the file with arbitrary PHP code via the admin panel, enabling remote code execution (system comm...

CVE-2025-57567

A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory /themes/defaut/css/minify.php. An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel,...

CVE-2025-57567

A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory /themes/defaut/css/minify.php. An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel,...

EUVD-2021-11068

Malware in sbrugna...

EUVD-2023-58347

Malicious code in bioql PyPI...

EUVD-2022-34701

Malicious code in bioql PyPI...

EUVD-2024-48457

Malicious code in bioql PyPI...

The theme editor in Bolt allows remote authenticated users to execute arbitrary code by renaming a crafted file

...

Exploit for Code Injection in Get-Simple Getsimple_Cms

CVE-2022-41544 - GetSimple CMS RCE Exploit Overview This...

CVE-2025-5425

A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor Page. The manipulation leads to improper access controls. It is possible to launch the attack remotely...

CVE-2025-5425

A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor Page. The manipulation leads to improper access controls. It is possible to launch the attack remotely...

CVE-2025-5425 juzaweb CMS Theme Editor Page default access control

A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor Page. The manipulation leads to improper access controls. It is possible to launch the attack remotely...

CVE-2025-5425 juzaweb CMS Theme Editor Page default access control

A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor Page. The manipulation leads to improper access controls. It is possible to launch the attack remotely...

CVE-2025-5425

CVE-2025-5425 affects juzaweb CMS up to 3.4.2. The vulnerability targets the Theme Editor Page component (file /admin-cp/theme/editor/default) and is due to improper access controls in that function, enabling a remote attack. An exploit has been publicly disclosed. The connected documents do not ...