Nelio Content Vulnerabilities

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.3.4. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an...

CVSS:

4.3

Affected:

up to 4.3.4

Fixed in:

4.3.5

Disclosed:

Jun 26, 2026

CVE-2026-57648 on NVD →

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.3.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations origi...

CVSS:

6.4

Affected:

up to 4.3.1

Fixed in:

4.3.2

Disclosed:

Mar 19, 2026

CVE-2026-39521 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio Content nelio-content allows Blind SQL Injection.This issue affects Nelio Content: from n/a through <= 4.1.0.

Affected:

up to 4.1.0

Fix:

No patched version reported

Disclosed:

Jan 23, 2026

CVE-2026-24572 on NVD →

The Nelio Content plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and ab...

CVSS:

6.5

Affected:

up to 4.2.0

Fixed in:

4.2.1

Disclosed:

Jan 21, 2026

CVE-2026-24572 on NVD →

[en] Missing Authorization vulnerability in Nelio Software Nelio Content nelio-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Content: from n/a through <= 4.0.5.

Affected:

up to 4.0.5

Fix:

No patched version reported

Disclosed:

Oct 27, 2025

CVE-2025-62927 on NVD →

The Nelio Content plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.0.5. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 4.0.5

Fixed in:

4.0.6

Disclosed:

Oct 5, 2025

CVE-2025-62927 on NVD →

[en] Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content.This issue affects Nelio Content: from n/a through 3.2.0.

Affected:

up to 3.2.1

Fixed in:

3.2.1

Disclosed:

Apr 2, 2024

CVE-2024-30531 on NVD →

The Nelio Content – Best Editorial Calendar & Social Media Scheduling plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.0. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations or...

CVSS:

6.4

Affected:

up to 3.2.0

Fixed in:

3.2.1

Disclosed:

Mar 29, 2024

CVE-2024-30531 on NVD →