Zoho Flow Vulnerabilities

The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zoho_flow_deactivate_plugin() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request...

CVSS:

4.3

Affected:

up to 2.14.1

Fixed in:

2.14.2

Disclosed:

Sep 22, 2025

CVE-2025-59568 on NVD →

The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zoho_flow_deactivate_plugin function. This makes it possible for unauthenticated attackers to modify typography settings via a forged reque...

CVSS:

4.3

Affected:

up to 2.14.1

Fixed in:

2.14.2

Disclosed:

Sep 10, 2025

CVE-2025-8479 on NVD →

The Zoho Flow – Integrate 100+ plugins with 1000+ business apps, no-code workflow automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with Subscriber-level a...

CVSS:

4.3

Affected:

up to 2.13.3

Fixed in:

2.13.4

Disclosed:

Apr 1, 2025

CVE-2025-31408 on NVD →

[en] Missing Authorization vulnerability in Zoho Flow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho Flow: from n/a through 2.13.3.

Affected:

up to 2.13.4

Fixed in:

2.13.4

Disclosed:

Apr 1, 2025

CVE-2025-31408 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Flow Zoho Flow for WordPress allows SQL Injection.This issue affects Zoho Flow for WordPress: from n/a through 2.7.1.

Affected:

up to 2.8.1

Fixed in:

2.8.1

Disclosed:

Oct 9, 2024

CVE-2024-47334 on NVD →

The Zoho Flow for WordPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level...

CVSS:

4.9

Affected:

up to 2.8.0

Fixed in:

2.8.1

Disclosed:

Sep 26, 2024

CVE-2024-47334 on NVD →