themeeditor CVE Vulnerabilities & Metrics

Focus on themeeditor vulnerabilities and metrics.

Last updated: 01 Aug 2025, 22:25 UTC

About themeeditor Security Exposure

This page consolidates all known Common Vulnerabilities and Exposures (CVEs) associated with themeeditor. We track both calendar-based metrics (using fixed periods) and rolling metrics (using gliding windows) to give you a comprehensive view of security trends and risk evolution. Use these insights to assess risk and plan your patching strategy.

For a broader perspective on cybersecurity threats, explore the comprehensive list of CVEs by vendor and product. Stay updated on critical vulnerabilities affecting major software and hardware providers.

Global CVE Overview

Total themeeditor CVEs: 2
Earliest CVE date: 05 Apr 2021, 19:15 UTC
Latest CVE date: 29 Aug 2024, 11:15 UTC

Latest CVE reference: CVE-2022-2440

Rolling Stats

30-day Count (Rolling): 0
365-day Count (Rolling): 1

Calendar-based Variation

Calendar-based Variation compares a fixed calendar period (e.g., this month versus the same month last year), while Rolling Growth Rate uses a continuous window (e.g., last 30 days versus the previous 30 days) to capture trends independent of calendar boundaries.

Variations & Growth

Month Variation (Calendar): 0%
Year Variation (Calendar): 0%

Month Growth Rate (30-day Rolling): 0.0%
Year Growth Rate (365-day Rolling): 0.0%

Monthly CVE Trends (current vs previous Year)

Annual CVE Trends (Last 20 Years)

Critical themeeditor CVEs (CVSS ≥ 9) Over 20 Years

CVSS Stats

Average CVSS: 2.0

Max CVSS: 4.0

Critical CVEs (≥9): 0

CVSS Range vs. Count

Range Count
0.0-3.9 1
4.0-6.9 1
7.0-8.9 0
9.0-10.0 0

CVSS Distribution Chart

Top 5 Highest CVSS themeeditor CVEs

These are the five CVEs with the highest CVSS scores for themeeditor, sorted by severity first and recency.

All CVEs for themeeditor

CVE-2022-2440 themeeditor vulnerability CVSS: 0 29 Aug 2024, 11:15 UTC

The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to, and including 2.8. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.

CVE-2021-24154 themeeditor vulnerability CVSS: 4.0 05 Apr 2021, 19:15 UTC

The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd