Wp Super Edit Vulnerabilities

The WP Super Edit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.5.4. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on the affected site's server which may make r...

CVSS:

8.8

Affected:

up to 2.5.4

Fix:

No patched version reported

Disclosed:

May 15, 2026

CVE-2021-47965 on NVD →

The Super Edit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tric...

CVSS:

6.1

Affected:

up to 2.5.4

Fix:

No patched version reported

Disclosed:

Jul 9, 2025

CVE-2025-49948 on NVD →