Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?CantoCanto Testimonials
Plugin · canto
Canto
9 known vulnerabilities on record. Add your version above to see which ones affect you.
Apr 17, 2026Canto: Missing AuthorizationCVE-2026-6441 · affects up to 3.1.1 · reported by WordfenceMedium 4.3
The Canto plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.1.1. This is due to the absence of any capability check or nonce verification in the updateOptions() function, which is exposed via two AJAX hooks: wp_ajax_updateOptions (class-canto.php line 231) and wp_ajax_fbc_updateOptions (class-canto-settings.php line 76). Both hooks are registered exclusively under the wp_ajax_ prefix (requiring only a logged-in user), with no call to current_user_can() or check_ajax_referer(). This makes it possible for authenticated attackers with subscriber-level access and above to arbitrarily modify or delete plugin options controlling cron scheduling behavior (fbc_duplicates, fbc_cron, fbc_schedule, fbc_cron_time_day, fbc_cron_time_hour, fbc_cron_start) and to manipulate or clear the plugin's scheduled WordPress cron event (fbc_scheduled_update).
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 21, 2026Canto: Missing AuthorizationCVE-2026-3335 · affects up to 3.1.1 · reported by WordfenceMedium 5.3
The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the `/wp-content/plugins/canto/includes/lib/copy-media.php` file. This is due to the file being directly accessible without any authentication, authorization, or nonce checks, and the `fbc_flight_domain` and `fbc_app_api` URL components being accepted as user-supplied POST parameters rather than read from admin-configured options. Since the attacker controls both the destination server and the `fbc_app_token` value, the entire fetch-and-upload chain is attacker-controlled — the server never contacts Canto's legitimate API, and the uploaded file originates entirely from the attacker's infrastructure. This makes it possible for unauthenticated attackers to upload arbitrary files (constrained to WordPress-allowed MIME types) to the WordPress uploads directory. Additional endpoints (`detail.php`, `download.php`, `get.php`, `tree.php`) are also directly accessible without authentication and make requests using a user-supplied `app_api` parameter combined with an admin-configured subdomain.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 14, 2024Canto: Remote File InclusionCVE-2024-4936 · affects up to 3.0.8 · reported by WordfenceCritical 9.8
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allow_url_include to be enabled on the target site in order to exploit.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 3, 2024Canto: Improper Control of Generation of Code ('Code Injection')CVE-2024-25096 · affects up to 3.0.7 · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7.
Aug 11, 2023Canto: Remote File InclusionCVE-2023-3452 · affects up to 3.0.4 · reported by WordfenceCritical 9.8
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 30, 2020The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability.CVE-2020-28978 · affects 1.3.0 to 1.3.0 · reported by MITREMedium 5.3
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/tree.php?subdomain=SSRF.
Nov 30, 2020The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability.CVE-2020-28977 · affects 1.3.0 to 1.3.0 · reported by MITREMedium 5.3
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/get.php?subdomain=SSRF.
Nov 30, 2020The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability.CVE-2020-28976 · affects 1.3.0 to 1.3.0 · reported by MITREMedium 5.3
The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF.
Nov 10, 2020The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.CVE-2020-24063 · affects 1.3.0 to 1.3.0 · reported by MITREHigh 7.2
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.