Skip to content
OpenAdvisories

Vendor

flightbycanto

4 known vulnerabilities.

Products

Canto 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-6441

    Canto <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification

    The Canto plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.1.1. This is due to the absence of any capability check or nonce verification in the updateOptions() function, which is exposed via two AJAX hooks: wp_ajax…

    flightbycanto Canto Web / CMS
  • Medium 5.3
    CVE-2026-3335 Scanner template

    Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

    The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the `/wp-content/plugins/canto/includes/lib/copy-media.php` file. This is due to the file being directly accessible without any authenticatio…

    flightbycanto Canto Web / CMS