Read the docs

Zoho Flow

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Zoho Flow records in CISA KEV

No Zoho Flow vulnerabilities are listed in CISA KEV.

Records

5 records

TI-2024-31652 CVE-2024-47334 · GHSA-q9h7-27gp-hwp9

WordPress Zoho Flow for WordPress plugin <= 2.7.1 - SQL Injection vulnerability

Priority LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Flow Zoho Flow zoho-flow allows SQL Injection.This issue affects Zoho Flow: from n/a through <= 2.7.1.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00418 Published 2024-10-09 No fix listed CWE-89
TI-2025-22589 CVE-2025-31408 · GHSA-hqj2-c48q-x9m8

WordPress Zoho Flow plugin <= 2.13.3 - Broken Access Control vulnerability

Priority LOW 20

Missing Authorization vulnerability in Zoho Flow Zoho Flow zoho-flow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho Flow: from n/a through <= 2.13.3.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00252 Published 2025-04-01 No fix listed CWE-862
TI-2025-07760 CVE-2025-8479 · GHSA-jcw2-q4qh-wxwx

Zoho Flow <= 2.14.1 - Cross-Site Request Forgery

Priority LOW 19

The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00189 Published 2025-09-11 No fix listed CWE-352
Open these records in search →