Softaculous vulnerabilities
We track 15 vulnerabilities in Softaculous products across 11 products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Softaculous vulnerabilities
- 8.1 High severity
Kanbanz: Authorization Bypass Through User-Controlled Key
Kanbanz by Softaculous plugin for WordPress before 1.0.3 contains a broken access control vulnerability that allows authenticated Kanban Staff users to access and modify boards they are not members of by exploiting admin-ajax handlers that fail to call kanbanz
- 7.2 High severity
GoSMTP Pro: Improper Neutralization of Input During Web Page Generation
The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthent
- 8.0 High severity
Backuply – Backup, Restore, Migrate and Clone: Improper Neutralization of Special Elements used in an SQL Command
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied para
- 7.5 High severity
Virtualizor: Missing Authorization
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and from_billing_
- 8.1 High severity
Virtualizor: Deserialization of Untrusted Data
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act
- 9.8 Critical severity
Virtualizor: Improper Neutralization of Special Elements used in an OS Command
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specifi
- 7.2 High severity
FileOrganizer – WordPress File Manager: Improper Limitation of a Pathname to a Restricted Directory
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.1.4 via the 'default_lang' parameter. This makes it possible for authenticated attackers, with
- 8.1 High severity
Loginizer Security: Improper Authentication
The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9.2. This is due to insufficient verification on the user being returned by the social login token. This makes it possibl
- 8.8 High severity
FileOrganizer – WordPress File Manager: Unrestricted Upload of File with Dangerous Type
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the "fileorganizer_ajax_handler" function in all versions up to, and including, 1.0.9. This makes it poss
- 7.2 High severity
Backuply – Backup, Restore, Migrate and Clone: Improper Neutralization of Special Elements used in an SQL Command
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter passed to the backuply_wp_clone_sql() function in all versions up to, and including, 1.3.4 due to insufficient escaping on the use
- 8.8 High severity
Webuzo: Improper Neutralization of Special Elements used in an OS Command
Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system.
- 8.8 High severity
Webuzo: Improper Neutralization of Special Elements used in an OS Command
Softaculous Webuzo contains a command injection in the password reset functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system.
- 9.8 Critical severity
Webuzo: Incorrect Comparison
Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full server access as the root user.
- 7.5 High severity
FileOrganizer – WordPress File Manager: Insecure Storage of Sensitive Information
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated at
- 7.5 High severity
Backuply – Backup, Restore, Migrate and Clone: Excessive Iteration
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 1.2.6. This is due to direct access of the backuply/restore_ins.php file and. This makes it possible for unauthentic