Wpcasa Vulnerabilities

The WPCasa plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will...

CVSS:

6.4

Affected:

up to 1.4.1

Fixed in:

1.4.2

Disclosed:

Oct 16, 2025

CVE-2025-62043 on NVD →

The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient input validation and restriction on the 'api_requests' function. This makes it possible for unauthenticated attackers to call arbitrary functions and execute code.

CVSS:

9.8

Affected:

up to 1.4.1

Fixed in:

1.4.2

Disclosed:

Sep 22, 2025

CVE-2025-9321 on NVD →

The WPCasa plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will...

CVSS:

6.4

Affected:

up to 1.3.2

Fixed in:

1.4.0

Disclosed:

Apr 16, 2025

CVE-2025-39575 on NVD →

The WPCasa plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.13 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to act on objects they shouldn't be able to manipulate.

CVSS:

5.3

Affected:

up to 1.2.13

Fixed in:

1.3.0

Disclosed:

Dec 2, 2024

CVE-2024-53826 on NVD →