Quick Playground vulnerabilities

2 known vulnerabilities in Quick Playground from Davidfcarr. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Quick Playground: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-6403May 15, 2026Davidfcarr

  The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, which appends a user-controlled 'stylesheet' parameter directly to

• 9.8 Critical severity

  Quick Playground: Missing Authorization

  CVE-2026-1830Apr 9, 2026DavidfcarrEPSS 8.09%

  The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file uploads. This