Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch
high
The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a filename validation/destination mismatch in fetch_remote_file,...
- CVSS:
- 8.8
- Affected:
- up to 3.7.1
- Fixed in:
- 3.7.2
- Disclosed:
- Aug 14, 2026
CVE-2026-18438 on NVD →
Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting
high
The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...
- CVSS:
- 7.2
- Affected:
- up to 3.7.1
- Fixed in:
- 3.7.2
- Disclosed:
- Aug 14, 2026
CVE-2026-66667 on NVD →
Templately <= 3.7.0 - Missing Authorization
medium
The Templately plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.7.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.
- CVSS:
- 5.3
- Affected:
- up to 3.7.0
- Fixed in:
- 3.7.1
- Disclosed:
- Aug 3, 2026
CVE-2026-15359 on NVD →
Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! <= 3.6.1 - Authenticated (Contributor+) Information Exposure
medium
The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract s...
- CVSS:
- 4.3
- Affected:
- up to 3.6.1
- Fixed in:
- 3.6.2
- Disclosed:
- Apr 27, 2026
CVE-2026-42379 on NVD →
Templately <= 3.4.8 - Unauthenticated Limited Arbitrary JSON File Write
medium
The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. This is due to inadequate input validation in the `save_template_to_file()` function where user-controlled parameters like `session_id`, `content_id`, and `ai_page_ids` are used to construct file paths...
- CVSS:
- 5.3
- Affected:
- up to 3.4.8
- Fixed in:
- 3.4.9
- Disclosed:
- Jan 9, 2026
CVE-2026-0831 on NVD →
Templately <= 3.2.7 - Authenticated (Author+) Information Disclosure
medium
The Templately – Elementor & Gutenberg Template Library: 5500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensit...
- CVSS:
- 4.3
- Affected:
- up to 3.2.7
- Fixed in:
- 3.2.8
- Disclosed:
- Aug 20, 2025
CVE-2025-49408 on NVD →
Templately <= 3.1.5 - Missing Authorization via AJAX actions
medium
The Templately plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions hooked into AJAX actions in versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to invoke those func...
- CVSS:
- 6.3
- Affected:
- up to 3.1.5
- Fixed in:
- 3.1.6
- Disclosed:
- Oct 24, 2024
CVE-2024-50424 on NVD →
Templately <= 3.1.5 - Missing Authorization
medium
The Templately plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with contributor-level access and above, to invoke those functions.
- CVSS:
- 4.3
- Affected:
- up to 3.1.5
- Fixed in:
- 3.1.6
- Disclosed:
- Oct 24, 2024
CVE-2024-50423 on NVD →
Templately <= 3.1.2 - Missing Authorization
medium
The Templately – Elementor & Gutenberg Template Library: 5000+ Free & Pro Ready Templates & Cloud! plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.1.2. This makes it possible for unauthenticated attackers to perform an una...
- CVSS:
- 5.3
- Affected:
- up to 3.1.2
- Fixed in:
- 3.1.3
- Disclosed:
- Sep 25, 2024
CVE-2024-47308 on NVD →
Templately <= 2.2.5 - Improper Authorization to Arbitrary Post Deletion
medium
The Templately plugin for WordPress is vulnerable to unauthorized loss of data due to an improper capability check on the 'delete' REST endpoint in versions up to, and including, 2.2.5. This makes it possible for authenticated attackers to delete arbitrary posts.
- CVSS:
- 6.5
- Affected:
- up to 2.2.5
- Fixed in:
- 2.2.6
- Disclosed:
- Oct 16, 2023
CVE-2023-5454 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database