Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · templately
Templately
10 known vulnerabilities on record. Add your version above to see which ones affect you.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.CVE-2026-66667 · affects up to 3.7.1 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
Aug 15, 2026Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!: Remote Code ExecutionCVE-2026-18438 · affects up to 3.7.1 · reported by WordfenceHigh 8.8
The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a filename validation/destination mismatch in fetch_remote_file, where file type validation is performed against the attacker-controlled Content-Disposition filename rather than the URL-path-derived destination filename. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. A GIF+PHP polyglot file passes wp_check_filetype_and_ext validation as image/gif via the Content-Disposition filename, while the actual destination path is written with a .php extension derived from the URL path, bypassing the unfiltered_upload capability gate entirely. The affected endpoints are reachable at this privilege level because Templately's entire REST API — including the cloud import endpoints used in this attack (/templately/v1/clouds/upload and /templately/v1/insert) — is authorized only by a current_user_can('delete_posts') check, with no administrator or manage_options capabili
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 7, 2026Templately: Does not have an authorisation check on one of its request handlersCVE-2026-15359 · fixed in 3.7.1 · reported by WPScanMedium 6.5
The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and redirecting the site's cloud template library to attacker-controlled content.
Apr 27, 2026Templately: Insertion of Sensitive Information Into Sent DataCVE-2026-42379 · affects up to 3.6.1 · reported by PatchstackHigh 7.7
Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data.This issue affects Templately: from n/a through 3.6.1.
Jan 10, 2026Templately: Arbitrary File WriteCVE-2026-0831 · affects up to 3.4.8 · reported by WordfenceMedium 5.3
The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. This is due to inadequate input validation in the `save_template_to_file()` function where user-controlled parameters like `session_id`, `content_id`, and `ai_page_ids` are used to construct file paths without proper sanitization. This makes it possible for unauthenticated attackers to write arbitrary `.ai.json` files to locations within the uploads directory.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 20, 2025Templately: Insertion of Sensitive Information Into Sent DataCVE-2025-49408 · affects up to 3.2.7 · reported by PatchstackCritical 10
Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data. This issue affects Templately: from n/a through 3.2.7.
Nov 1, 2024Templately: Missing AuthorizationCVE-2024-47308 · affects up to 3.1.2 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper Templately templately.This issue affects Templately: from n/a through <= 3.1.2.
Oct 29, 2024Templately: Missing AuthorizationCVE-2024-50424 · affects up to 3.1.5 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through <= 3.1.5.
Oct 29, 2024Templately: Missing AuthorizationCVE-2024-50423 · affects up to 3.1.5 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through <= 3.1.5.
Nov 6, 2023Templately: Does not properly authorize the `saved-templates/delete` REST API callCVE-2023-5454 · fixed in 2.2.6 · reported by WPScanHigh 7.5
The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete arbitrary posts.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.