WonderCMS vulnerabilities
We track 4 vulnerabilities in WonderCMS products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on December 12, 2025.
Latest WonderCMS vulnerabilities
- 8.8 High severity
WonderCMS: Improper Neutralization of Input During Web Page Generation
WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remo
- 7.2 High severity
WonderCMS: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload. The a
- 9.6 Critical severity
wondercms: Improper Neutralization of Input During Web Page Generation
A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the WEBSITE TITLE parameter under the Menu module.
- 8.1 High severity
wondercms: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the installThemePlugin parameter.