CodeCanyon vulnerabilities
We track 7 vulnerabilities in CodeCanyon products across 7 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on November 16, 2025.
Latest CodeCanyon vulnerabilities
- 7.5 High severity
A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce…
A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5. Affected by this issue is some unknown functionality of the file /submit_checkout. Such manipulation of the argument order_total_amount/cart_
- 7.2 High severity
News365: Unrestricted Upload of File with Dangerous Type
A security flaw has been discovered in Bdtask/CodeCanyon News365 up to 7.0.3. This affects an unknown function of the file /admin/dashboard/profile. The manipulation of the argument profile_image/banner_image results in unrestricted upload. The attack can be l
- 8.8 High severity
SalesERP: Cross-Site Request Forgery
A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. This affects an unknown part. The manipulation results in cross-site request forgery. The attack can be executed remotely. The exploit is now public and may be used. The vendor was cont
- 7.2 High severity
iDentSoft: Improper Access Control
A vulnerability was found in Codecanyon iDentSoft 2.0. It has been classified as critical. This affects an unknown part of the file /clinica/profile/updateSetting of the component Account Setting Page. The manipulation of the argument photo leads to unrestrict
- 9.1 Critical severity
WooEvents - Calendar and Event Booking: Improper Limitation of a Pathname to a Restricted Directory
The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/barcode.php file in all versions up to, and including, 4.1.2. This makes it possible for unauthenticat
- 8.8 High severity
RISE Ultimate Project Manager: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in CodeCanyon RISE Ultimate Project Manager 3.7.0 and classified as critical. This vulnerability affects unknown code of the file /index.php/dashboard/save. The manipulation of the argument id leads to sql injection. The attack c
- 9.8 Critical severity
Credit Lite: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /portal/reports/account_statement of the component POST Request Handler. The manipulation of the argument d