CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2025-26534 – WordPress Helloprint Plugin <= 2.0.7 - Arbitrary File Deletion vulnerability
https://notcve.org/view.php?id=CVE-2025-26534
22 Feb 2025 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound Helloprint allows Path Traversal. This issue affects Helloprint: from n/a through 2.0.7. The Plug your WooCommerce into the largest catalog of customized print products from Helloprint plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 2.0.7. This makes it possible for unauthenticated attackers to dele... • https://patchstack.com/database/wordpress/plugin/helloprint/vulnerability/wordpress-helloprint-plugin-2-0-7-arbitrary-file-deletion-vulnerability?_s_id=cve • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2025-26540 – WordPress Helloprint Plugin <= 2.0.7 - Arbitrary File Deletion vulnerability
https://notcve.org/view.php?id=CVE-2025-26540
22 Feb 2025 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound Helloprint allows Path Traversal. This issue affects Helloprint: from n/a through 2.0.7. The Plug your WooCommerce into the largest catalog of customized print products from Helloprint plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 2.0.7. This makes it possible for authenticated attackers, with Sub... • https://patchstack.com/database/wordpress/plugin/helloprint/vulnerability/wordpress-helloprint-plugin-2-0-7-arbitrary-file-deletion-vulnerability-2?_s_id=cve • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-50525 – WordPress Helloprint plugin <= 2.0.2 - Arbitrary File Upload vulnerability
https://notcve.org/view.php?id=CVE-2024-50525
30 Oct 2024 — Unrestricted Upload of File with Dangerous Type vulnerability in Helloprint Plug your WooCommerce into the largest catalog of customized print products from Helloprint allows Upload a Web Shell to a Web Server.This issue affects Plug your WooCommerce into the largest catalog of customized print products from Helloprint: from n/a through 2.0.2. The Plug your WooCommerce into the largest catalog of customized print products from Helloprint plugin for WordPress is vulnerable to arbitrary file uploads due to mi... • https://patchstack.com/database/vulnerability/helloprint/wordpress-helloprint-plugin-2-0-2-arbitrary-file-upload-vulnerability?_s_id=cve • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.4EPSS: 23%CPEs: 1EXPL: 1CVE-2022-3908 – Helloprint < 1.4.7 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-3908
15 Nov 2022 — The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting El complemento Helloprint WordPress anterior a 1.4.7 no sanitiza ni escapa un parámetro antes de devolverlo a la página, lo que genera cross site scripting reflejado. The Helloprint plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘success’ parameter in versions up to, and including, 1.4.6 due to insufficient inpu... • https://wpscan.com/vulnerability/c44802a0-8cbe-4386-9523-3b6cb44c6505 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •