Vulnerabilities

TI-2026-82515 CVE-2026-62131 · GHSA-6pvh-h9mv-qrhc

PHP object injection in WordPress Zoho Flow plugin

MEDIUM 49

Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-29 No fix listed CWE-502

TI-2025-37098 CVE-2025-59568 · GHSA-9r8r-2h8q-8hjf

WordPress Zoho Flow Plugin <= 2.14.1 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in Zoho Flow Zoho Flow zoho-flow allows Cross Site Request Forgery.This issue affects Zoho Flow: from n/a through <= 2.14.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0014 Published 2025-09-22 No fix listed CWE-352

TI-2025-07760 CVE-2025-8479 · GHSA-jcw2-q4qh-wxwx

Zoho Flow <= 2.14.1 - Cross-Site Request Forgery

LOW 19

The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00189 Published 2025-09-11 No fix listed CWE-352

TI-2025-22589 CVE-2025-31408 · GHSA-hqj2-c48q-x9m8

WordPress Zoho Flow plugin <= 2.13.3 - Broken Access Control vulnerability

LOW 20

Missing Authorization vulnerability in Zoho Flow Zoho Flow zoho-flow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho Flow: from n/a through <= 2.13.3.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00252 Published 2025-04-01 No fix listed CWE-862

TI-2024-31652 CVE-2024-47334 · GHSA-q9h7-27gp-hwp9

WordPress Zoho Flow for WordPress plugin <= 2.7.1 - SQL Injection vulnerability

LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Flow Zoho Flow zoho-flow allows SQL Injection.This issue affects Zoho Flow: from n/a through <= 2.7.1.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00418 Published 2024-10-09 No fix listed CWE-89