Skip to content
OpenAdvisories

Vendor

jiangweifang

2 known vulnerabilities.

Products

Live2DWebCanvas 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2026-92895

    Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter

    The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the download_one_file function. This is due to missing file extension whitelist and MIME type validation in download_one_file() whe…

    jiangweifang Live2DWebCanvas Web / CMS
  • High 8.1
    CVE-2024-13767

    Live2DWebCanvas <= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletion

    The Live2DWebCanvas plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ClearFiles() function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with Subs…

    jiangweifang Live2DWebCanvas Web / CMS