Wpide File Manager Code Editor
Monthly
Cross-site scripting in WPIDE - File Manager & Code Editor (WordPress plugin by xplodedthemes, versions ≤ 3.5.7) permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of users who visit a page containing the malicious payload. The CVSS scope change (S:C) indicates the injected script executes beyond the plugin's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim user - particularly damaging if the victim is an authenticated WordPress administrator with access to file management and code editing features. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-Site Request Forgery in the WPIDE - File Manager & Code Editor WordPress plugin (versions <= 3.5.6) allows a remote attacker to forge privileged requests that a logged-in administrator's browser executes without consent. Because WPIDE exposes filesystem read/write and code-editing functionality, a successful CSRF can lead to arbitrary file modification and effectively remote code execution on the WordPress host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Cross-site scripting in WPIDE - File Manager & Code Editor (WordPress plugin by xplodedthemes, versions ≤ 3.5.7) permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of users who visit a page containing the malicious payload. The CVSS scope change (S:C) indicates the injected script executes beyond the plugin's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim user - particularly damaging if the victim is an authenticated WordPress administrator with access to file management and code editing features. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-Site Request Forgery in the WPIDE - File Manager & Code Editor WordPress plugin (versions <= 3.5.6) allows a remote attacker to forge privileged requests that a logged-in administrator's browser executes without consent. Because WPIDE exposes filesystem read/write and code-editing functionality, a successful CSRF can lead to arbitrary file modification and effectively remote code execution on the WordPress host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.