Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: themeum Component: Droip Clear all filters
TI-2025-05263 CVE-2025-5835 · GHSA-h7f2-69qh-3xqc

Droip <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Many Actions

Priority MEDIUM 40

The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up to, and including, 2.2.6.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00412 Published 2025-07-25 No fix listed CWE-862
TI-2025-05259 CVE-2025-5831 · GHSA-qcv8-39fr-gcc3

Droip < 2.5.2 - Authenticated (Subscriber+) Arbitrary File Upload

Priority MEDIUM 41

The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all versions up to, and excluding, 2.5.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00745 Published 2025-07-25 Fixed in 2.5.2 CWE-434