Vulnerabilities

TI-2026-47295 CVE-2026-66624 · GHSA-qq9c-36g8-f2xx

WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability

LOW 33

Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00383 Published 2026-09-17 No fix listed CWE-89

TI-2026-30979 CVE-2026-42756 · GHSA-7hfx-87f9-p7x4

Path traversal in Ludwig You QuickWebP – Compress / Optimize Images & Convert…

MEDIUM 43

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly quickwebp allows Path Traversal.Th…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00336 Published 2026-05-27 No fix listed CWE-22

TI-2026-19661 CVE-2026-24388 · GHSA-97xc-c5w3-hfx3

WordPress WPMasterToolKit plugin <= 2.14.0 - Broken Access Control vulnerability

LOW 19

Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMasterToolKit: from n/a through <= 2.14.0.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0022 Published 2026-01-22 No fix listed CWE-862

TI-2025-12946 CVE-2025-14166 · GHSA-7q5g-8744-p89w

WPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection

LOW 30

The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00465 Published 2025-12-12 No fix listed CWE-94

TI-2025-02888 CVE-2025-3300 · GHSA-9mx9-xf85-m8v5

WPMasterToolKit (WPMTK) – All in one plugin <= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Write

LOW 35

The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00893 Published 2025-04-24 No fix listed CWE-22

TI-2024-37219 CVE-2024-56249 · GHSA-8h26-c5c4-6x9m

WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerability

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Upload a Web Shell to a Web Server.This issue affects WPMasterToolKit: from n/a through <= 1.13.1.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01255 Published 2025-01-02 No fix listed CWE-434

TI-2024-37218 CVE-2024-56248 · GHSA-qvxg-q7w7-8727

WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Download vulnerability

LOW 23

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Path Traversal.This issue affects WPMasterToolKit: from n/a through <= 1.1…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00547 Published 2025-01-02 No fix listed CWE-22