Droip vulnerabilities
2 known vulnerabilities affecting droip/droip.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH2
Vulnerabilities
Page 1 of 1
CVE-2025-5831P2HIGHCVSS 8.8fixed in 2.5.22025-07-25
CVE-2025-5831 [HIGH] CWE-434 CVE-2025-5831: The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type vali
The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may ma
nvd
CVE-2025-5835P3HIGHCVSS 8.8≤ 2.2.62025-07-25
CVE-2025-5835 [HIGH] CWE-862 CVE-2025-5835: The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to
The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform many actions as the AJAX hooks to several funct
nvd