WordPress security by component

Canto

Plugin description

Canto is a WordPress component with 9 published CVE records in this archive. The latest tracked vulnerability was published Apr 17, 2026; the highest CVE/CNA score is 10.

Plugin slug: canto

Latest vulnerability

CVE-2026-6441: Canto: A security weakness

Canto is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.1.1.

PublishedApr 17, 2026

Known safe version> 3.1.1

		Safe version
Apr 17, 2026	CVE-2026-6441 Canto: A security weakness Canto is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.1.1.	> 3.1.1	CVE4.3 NVDPending
Mar 21, 2026	CVE-2026-3335 Canto: A security weakness Canto is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Jun 14, 2024	CVE-2024-4936 Canto: A security weakness Canto is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE9.8 NVDPending
Apr 03, 2024	CVE-2024-25096 Canto: Code execution Canto is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE10.0 NVD9.8
Aug 12, 2023	CVE-2023-3452 Canto: Filesystem traversal Canto is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE9.8 NVDPending
Nov 30, 2020	CVE-2020-28978 Canto: Server-side request forgery Canto is affected by server-side request forgery. The vulnerable path is reachable without authentication. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE5.3 NVD5.3
Nov 30, 2020	CVE-2020-28977 Canto: Server-side request forgery Canto is affected by server-side request forgery. The vulnerable path is reachable without authentication. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE5.3 NVD5.3
Nov 30, 2020	CVE-2020-28976 Canto: Server-side request forgery Canto is affected by server-side request forgery. The vulnerable path is reachable without authentication. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE5.3 NVD5.3
Nov 10, 2020	CVE-2020-24063 Canto: Server-side request forgery Canto is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE7.2 NVD7.2