Theme Editor

Theme Editor has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; 6 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 4 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 4 of the records (57%). Other recurring categories include Deserialization Of Untrusted Data, Path Traversal.

6 of the records (86%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

6 independent researchers contributed these findings, one record each. Theme Editor is installed on roughly 50,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.5/ 10

Patch Coverage86%

Open

Fixed

Get automatic notifications for all Theme Editor vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2026-39640

Theme Editor <= 3.2 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

7 records


2026-07-31 18:34	Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification Theme Editor <= 3.1	`CVE-2025-14469`	4.3 Medium	Nabil Irawan	Yes
2026-02-14 00:00	Theme Editor <= 3.2 - Cross-Site Request Forgery Theme Editor <= 3.2	`CVE-2026-39640`	4.3 Medium	hhhai	No
2025-10-17 19:39	Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution Theme Editor <= 3.0	`CVE-2025-9890`	8.8 High	Jonas Benjamin Friedli	Yes
2024-08-28 00:00	Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization Theme Editor <= 2.8	`CVE-2022-2440`	7.2 High	Rasoul Jahanshahi	Yes
2023-11-20 00:00	Theme Editor <= 2.7.1 - Authenticated (Administrator+) Arbitrary File Upload Theme Editor <= 2.7.1	`CVE-2023-6091`	7.2 High	Dateoljo of BoB 12th	Yes
2021-02-13 00:00	Theme Editor <= 2.5 - Authenticated Arbitrary File Download Theme Editor <= 2.5	`CVE-2021-24154`	4.9 Medium	Nguyen Van Khanh	Yes
2019-09-30 00:00	Theme Editor <= 2.1 - Cross-Site Request Forgery Theme Editor < 2.2	`N/A`	8.8 High	Anonymous	Yes

Showing 1–7 of 7 reports

Latestv3.2

Theme Editor

Author

mndpsingh287

4.6(128)

92/100

Last Updated

2026-03-19 (6mo ago)

Active Installs

50,000+

Downloads

937,487

Requires WP

3.4+

Requires PHP

5.2.4+

Tested up to

WP 6.9.7

Created

2017-04-24 (10y ago)

Theme Editor allows you to edit theme files, create folder, upload files and remove any file and folder in themes and plugins. You can easily customize you themes and plugins directly. Upgrade to Pro Version Key Features in Theme Editor Plugin Edit Theme and Plugin Files Code Editors – Supports PHP, HTML, CSS and JavaScript Fancy Box Code Mirror Create and remove folder in themes and plugins Create and remove files in themes and plugins upload and download files in themes and plugins Download whole theme and plugin. Create New Child Theme Duplicate Existing Child Theme Query / Selector Move File from Parent Theme To Child Theme Upload New Images and Download Images Change and Upload New Screenshot of Selected Theme View All Images of Selected Theme Extended Features in Theme Editor Plugin Users Permissions User Role Permissions Email Notifications to Admin Edit Theme Files Code Editors Supports PHP, HTML, CSS and JavaScript Fancy Box Code Mirror Create and remove folder in themes Create and remove files in themes Upload and download files in themes Download whole theme. Edit Plugin Files Create and remove folder in plugins Create and remove files in plugins Upload and download files in plugins Download whole plugin. Create New Child Theme Duplicate Existing Child Theme Query / Selector Move File from Parent Theme To Child Theme Upload New Images and Download Images Change and Upload New Screenshot of Selected Themes View All Images of Selected Theme Preview Theme Child Theme Permission Upgrade to Pro Version Support If any problem occurs, please contact us at http://themeeditor.pro/contact Minimum requirements for Theme Editor WordPress 3.3+ PHP 5.x MySQL 5.x If any problem occurs, please contact us at http://themeeditor.pro/contact.

View on WordPress.org