Helloprint Vulnerabilities

[en] The Helloprint plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.2. This is due to the plugin registering a public REST API endpoint without implementing authorization checks to verify request authenticity. This makes it possible for unauthenticated attackers to arbi...

Affected:

up to 2.1.2

Fix:

No patched version reported

Disclosed:

Dec 6, 2025

CVE-2025-13666 on NVD →

The Helloprint plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.2. This is due to the plugin registering a public REST API endpoint without implementing authorization checks to verify request authenticity. This makes it possible for unauthenticated attackers to arbitrari...

CVSS:

5.3

Affected:

up to 2.1.2

Fix:

No patched version reported

Disclosed:

Dec 5, 2025

CVE-2025-13666 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound Helloprint allows Path Traversal. This issue affects Helloprint: from n/a through 2.0.7.

Affected:

up to 2.1.0

Fixed in:

2.1.0

Disclosed:

Mar 3, 2025

CVE-2025-26540 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound Helloprint allows Path Traversal. This issue affects Helloprint: from n/a through 2.0.7.

Affected:

up to 2.1.0

Fixed in:

2.1.0

Disclosed:

Mar 3, 2025

CVE-2025-26534 on NVD →

The Plug your WooCommerce into the largest catalog of customized print products from Helloprint plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 2.0.7. This makes it possible for unauthenticated attackers to delete...

CVSS:

9.1

Affected:

up to 2.0.7

Fixed in:

2.1.0

Disclosed:

Feb 22, 2025

CVE-2025-26534 on NVD →

The Plug your WooCommerce into the largest catalog of customized print products from Helloprint plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 2.0.7. This makes it possible for authenticated attackers, with Subsc...

CVSS:

8.1

Affected:

up to 2.0.7

Fixed in:

2.1.0

Disclosed:

Feb 22, 2025

CVE-2025-26540 on NVD →

[en] Unrestricted Upload of File with Dangerous Type vulnerability in Helloprint Plug your WooCommerce into the largest catalog of customized print products from Helloprint allows Upload a Web Shell to a Web Server.This issue affects Plug your WooCommerce into the largest catalog of customized print products from Hello...

Affected:

up to 2.0.5

Fixed in:

2.0.5

Disclosed:

Nov 4, 2024

CVE-2024-50525 on NVD →

The Plug your WooCommerce into the largest catalog of customized print products from Helloprint plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on...

CVSS:

9.8

Affected:

up to 2.0.4

Fixed in:

2.0.5

Disclosed:

Oct 30, 2024

CVE-2024-50525 on NVD →

[en] The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Affected:

up to 1.4.7

Fixed in:

1.4.7

Disclosed:

Dec 12, 2022

CVE-2022-3908 on NVD →

The Helloprint plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'success' parameter in versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i...

CVSS:

6.1

Affected:

up to 1.4.6

Fixed in:

1.4.7

Disclosed:

Nov 15, 2022

CVE-2022-3908 on NVD →