Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?WP EditorBootstrap Blocks for WP Editor v2SCSS WP EditorWP Editor.md – The Perfect WordPress Markdown Editor
Plugin · wp-editor
WP Editor
10 known vulnerabilities on record. Add your version above to see which ones affect you.
May 1, 2026WP Editor: Cross-Site Request ForgeryCVE-2026-3772 · affects up to 1.2.9.2 · reported by WordfenceHigh 8.8
The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2025WP Editor: Arbitrary file readCVE-2025-3295 · affects up to 1.2.9.1 · reported by WordfenceMedium 4.9
The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive information.
Apr 17, 2025WP Editor: Arbitrary file updateCVE-2025-3294 · affects up to 1.2.9.1 · reported by WordfenceHigh 7.2
The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server.
Sep 13, 2024WP Editor: Deserialization of untrusted inputCVE-2022-2446 · affects up to 1.2.9 · reported by WordfenceHigh 7.2
The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Mar 27, 2024WP Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24700 · affects up to 1.2.8 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Rojas WP Editor allows Reflected XSS.This issue affects WP Editor: from n/a through 1.2.8.
Mar 17, 2024WP Editor: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-25591 · affects up to 1.2.7 · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Benjamin Rojas WP Editor.This issue affects WP Editor: from n/a through 1.2.7.
Jan 16, 2024WP Editor: Did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameterCVE-2021-24151 · fixed in 1.2.7 · reported by WPScanHigh 7.2
The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the settings.
Aug 14, 2019The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.CVE-2016-10886 · fixed in 1.2.6 · reported by MITRECritical 9.8
The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
Aug 14, 2019The wp-editor plugin before 1.2.6 for WordPress has CSRF.CVE-2016-10885 · fixed in 1.2.6 · reported by MITREHigh 8.8
The wp-editor plugin before 1.2.6 for WordPress has CSRF.
Aug 12, 2019The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.CVE-2016-10877 · fixed in 1.2.6.3 · reported by MITREMedium 6.1
The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.