License For Envato
License For Envato has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 2 are fixed as of September 2026. Their average CVSS score is 8.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include PHP Remote File Inclusion.
Every one of the 2 issues recorded for License For Envato has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. License For Envato is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-39399License For Envato <= 1.0.0 - Unauthenticated Local File Inclusion
Read the full analysisVulnerability Records
License For Envato
Author
Ashraful Sarkar Naiem
Are you a theme or plugin developer selling your products on the Envato market? Struggling to manage purchase-code licenses across multiple customer domains? License For Envato is the solution. Install this plugin on your WordPress site to turn it into a fully-featured license server. It validates Envato purchase codes through the official Envato API and stores per-domain activation records in your database. Your customers activate their copy directly from your theme or plugin settings page — no third-party service required. Need activation limits, automatic updates, webhooks, blacklisting or an analytics dashboard? Check out License For Envato Pro. 🔑 How It Works Server Setup — Install the plugin on your WordPress site and connect your Envato personal token. Client Integration — Copy the provided PHP class into your theme or plugin and point it at your server URL. Display the Form — Instantiate the class on your settings page to render an activate/deactivate form for your customers. ⚡ Free Features Easy one-time server setup Validates purchase codes via the official Envato API Per-domain license activation and deactivation REST API endpoints for client integration (/wp-json/licenseenvato/v1/active, /wp-json/licenseenvato/v1/deactive) Copy-paste PHP integration class included Search and manage verified licenses from the admin panel Secure token-based activation flow (AES-256-CBC encrypted storage) Lightweight and fast — no external dependencies at runtime 🚀 Pro Features Need more than the basics? License For Envato Pro adds: Multiple domain activations per license, with configurable limits Support-expiry enforcement, with on-demand renewal re-sync from Envato Email notifications + a daily expiry-warning digest Webhooks with signed payloads for your own integrations Purchase code & domain blacklist Activity log with CSV export Manual & bulk license issuance — no Envato purchase required Automatic update delivery for your own themes/plugins (self-hosted, outside WordPress.org) Analytics dashboard Priority support Get it at https://codeholt.com/products/license-envato-pro/ 📖 Documentation Full documentation is available at https://ashrafulsarkar.github.io/license-envato/ 🐙 GitHub https://github.com/ashrafulsarkar/license-envato
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C