Kleor vulnerabilities
We track 5 vulnerabilities in Kleor products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest Kleor vulnerabilities
- 9.8 Critical severity
Contact Manager: Unrestricted Upload of File with Dangerous Type
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing
- 7.1 High severity
Contact Manager: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kleor Contact Manager contact-manager allows Reflected XSS.This issue affects Contact Manager: from n/a through <= 9.1.
- 8.8 High severity
Contact Manager: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Kleor Contact Manager contact-manager allows Object Injection.This issue affects Contact Manager: from n/a through <= 9.1.1.
- 7.2 High severity
Easy Timer: Improper Control of Generation of Code
The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attack
- 8.1 High severity
Contact Manager: Unrestricted Upload of File with Dangerous Type
The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all versions up to, and including, 8.6.4. This makes it possible for unauthenticated attackers to upload