Canto

Canto has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; all 9 are fixed as of September 2026. Their average CVSS score is 8.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 4 high. 2020 was the busiest year with 4 disclosures.

The most common weakness is Server-Side Request Forgery (SSRF), behind 4 of the records (44%). Other recurring categories include PHP Remote File Inclusion, Missing Authorization.

Every one of the 9 issues recorded for Canto has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, most of them (4) reported by Pankaj Verma. Canto is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh

8.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Canto vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-4936

Canto <= 3.0.8 - Unauthenticated Remote File Inclusion

Read the full analysis

Vulnerability Records

9 records


2026-04-16 18:16	Canto <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification Canto <= 3.1.1	`CVE-2026-6441`	4.3 Medium	Legion Hunter	Yes
2026-03-20 15:13	Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload Canto <= 3.1.1	`CVE-2026-3335`	5.3 Medium	oddshacker	Yes
2024-06-13 15:59	Canto <= 3.0.8 - Unauthenticated Remote File Inclusion Canto <= 3.0.8	`CVE-2024-4936`	9.8 Critical	Sushi Com Abacate	Yes
2024-02-12 00:00	Canto <= 3.0.6 - Remote File Inclusion to Code Execution Canto <= 3.0.6	`CVE-2024-25096`	9.8 Critical	Rodrigo Escobar (ipax)	Yes
2023-08-09 00:00	Canto <= 3.0.4 - Unauthenticated Remote File Inclusion Canto <= 3.0.4	`CVE-2023-3452`	9.8 Critical	Marco Wotschka	Yes
2020-12-04 00:00	Canto <= 1.9.0 - Blind Server-Side Request Forgery via detail.php Canto <= 1.9.0	`CVE-2020-28976`	8.3 High	Pankaj Verma	Yes
2020-11-30 00:00	Canto <= 1.9.0 - Blind Server-Side Request Forgery via download.php Canto <= 1.9.0	`CVE-2020-24063`	8.3 High	Pankaj Verma	Yes
2020-03-12 00:00	Canto <= 1.9.0 - Blind Server-Side Request Forgery via get.php Canto <= 1.9.0	`CVE-2020-28977`	8.3 High	Pankaj Verma	Yes
2020-03-12 00:00	Canto <= 1.9.0 - Blind Server-Side Request Forgery via tree.php Canto < 2.0.1	`CVE-2020-28978`	8.3 High	Pankaj Verma	Yes

Showing 1–9 of 9 reports

Latestv3.1.3

Canto

Author

Canto

0.0(0)

0/100

Last Updated

2026-06-04 (3mo ago)

Active Installs

100+

Downloads

16,590

Requires WP

5.0+

Requires PHP

Tested up to

WP 7.0.4

Created

2018-06-09 (8y ago)

Simplify collaboration: Publish media from Canto to WordPress. Browse/search your library directly. Inserted images save to WordPress.

View on WordPress.org