XplodedThemes wpide vulnerabilities

Latest XplodedThemes wpide CVEs

Newest publication first

1. CVE-2024-9546 WPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosure

   Published 2024-10-14

   Medium·CVSS 5.3 EPSS 0.53%

   The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possibl...

2. CVE-2022-40217 WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Edit/Upload vulnerability

   Published 2022-09-21

   High·CVSS 7.2 EPSS 1.1%

   Authenticated (admin+) Arbitrary File Edit/Upload vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.

3. CVE-2022-2261 WPide < 3.0 - Admin+ Local File Inclusion

   Published 2022-08-29

   High·CVSS 7.2 EPSS 1.5%

   The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.