plugin

Cnvrse Vulnerabilities

2 known security issues reported for the Cnvrse WordPress plugin. Most recent disclosed Feb 20, 2026.

1 medium

Running Cnvrse on your site? Check whether your installed version is affected.

Cnvrse [cnvrse] <= 026.02.10.20 (unfixed)

unknown

[en] Authorization Bypass Through User-Controlled Key vulnerability in cnvrse Cnvrse cnvrse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cnvrse: from n/a through <= 026.02.10.20.

Affected:: up to 026.02.10.20
Fix:: No patched version reported
Disclosed:: Feb 20, 2026

CVE-2025-69394 on NVD →

Cnvrse < 026.02.10.20 - Unauthenticated Insecure Direct Object Reference

medium

The Cnvrse plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and excluding, 026.02.10.20 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:: 5.3
Affected:: up to 026.02.10.20
Fixed in:: 026.02.10.20
Disclosed:: Feb 11, 2026

CVE-2025-69394 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database