WordPress plugin
Simple Theme Changer security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High0
- Medium2
- Low0
All Simple Theme Changer vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Missing Authorization to Plugin Settings Update via AJAX Actions ≤1.0No patch available | CVE-2025-14392 | |
| Medium4.3 | Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update ≤1.0No patch available | CVE-2025-14391 |
- Medium4.3Missing Authorization to Plugin Settings Update via AJAX Actions
≤1.0No patch available
- Medium4.3Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update
≤1.0No patch available
Simple Theme Changer: common questions
Does Simple Theme Changer have known vulnerabilities?
Yes. VulnCrest Radar lists 2 known vulnerabilities in Simple Theme Changer: 2 medium. At least one is not fixed in the latest version.
How do I check which version of Simple Theme Changer I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Simple Theme Changer vulnerability?
CVE-2025-14392, published Dec 11, 2025: Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions. Severity: Medium (CVSS 4.3).
Is any Simple Theme Changer vulnerability listed in CISA KEV?
No. None of the known Simple Theme Changer vulnerabilities is currently listed in the CISA KEV catalog.