WordPress wp-editor has 6 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2016-10886 | The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions. | critical | 9.8 | <1.2.6 | 1.2.6 |
| CVE-2025-3294 | The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and inc | high | 7.2 | <1.2.9.2 | 1.2.9.2 |
| CVE-2021-24151 | The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL i | high | 7.2 | <1.2.7 | 1.2.7 |
| CVE-2016-10885 | The wp-editor plugin before 1.2.6 for WordPress has CSRF. | high | 8.8 | <1.2.6 | 1.2.6 |
| CVE-2022-2446 | The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up | high | 7.2 | <1.2.9.1 | 1.2.9.1 |
| CVE-2025-3295 | The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possibl | medium | 4.9 | <1.2.9.2 | 1.2.9.2 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked