Live2DWebCanvas

Live2DWebCanvas has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 8.1, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for Live2DWebCanvas has a vendor fix available, so running the current release closes it.

All of these findings were reported by Lucio Sá. Live2DWebCanvas is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh

8.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Live2DWebCanvas vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2024-13767

Live2DWebCanvas <= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletion

Read the full analysis

Vulnerability Records

1 records


2025-01-30 14:13	Live2DWebCanvas <= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletion Live2DWebCanvas <= 1.9.11	`CVE-2024-13767`	8.1 High	Lucio Sá	Yes

Showing 1–1 of 1 reports

Plugin Profile

Latestv2.2.1

Live2DWebCanvas

Author

天堂菌

5.0(8)

100/100

Last Updated

2026-06-02 (3mo ago)

Active Installs

50+

Downloads

16,277

Requires WP

5.5+

Requires PHP

7.4+

Tested up to

WP 7.0.4

Created

2020-06-25 (6y ago)

支持moc和moc3模型的插件。 Live2D Cubism Core 再配布声明本插件随包分发 Live2D Cubism Core 6.x（位于 assets/cubism-core/，包含 live2dcubismcore.min.js 与随附的 LICENSE.md / RedistributableFiles.txt）。该部分文件遵循 Live2D Proprietary Software License Agreement，与本插件主体的 MIT 许可独立，未随本插件重新许可。协议全文：https://www.live2d.com/eula/live2d-proprietary-software-license-agreement_cn.html 该目录下的 live2dcubismcore.min.js 依据官方 RedistributableFiles.txt 清单允许再配布，二次分发者请保留该目录内原始 LICENSE / RedistributableFiles 文件。二次分发者需要求未来的 distributor 与终端用户接受与原协议同等效力的保护条款（EULA 5.2.2）。与本插件及 Cubism Core 相关的第三方费用 / 诉讼须由二次分发者自行免责、抗辩与补偿 Live2D 公司（EULA 5.2.3）。插件作者与 Live2D Inc. 无雇佣关系，但保持官方合作关系；如需出版由 Cubism Core 驱动的派生作品（插件本身均属于“拓展性应用”），请参考 EULA 第 2 条、第 6.3 条自行与 Live2D 公司签订 Live2D 出版许可协议。特性与株式会社Live2D（ Live2D Inc. ）签订合约, 本软件是使用Cubism SDK for Web核心制作的可扩展性应用程序, 本软件为正版授权。使用 Cubism 4+ 生成的模型必须购买此插件才可以使用。插件可以通过后台直接对Live2D进行设置，无需复杂的修改代码。可视化设置并生成waifu-tips.json，避免手动修改JSON 版权声明 live2d_src / ©journey-ad / GPL v2.0 本插件本体遵循 MIT 许可证（见 LICENSE 文件）。上游 live2d_src 原作品仍受其 GPL v2.0 约束，请保留其原始版权与许可声明。 Live2DWebCanvas 插件不属于 Live2D Inc. 它是一个非官方产品。软件许可协议 Live2D Proprietary Software License Agreement Live2D Open Software License Agreement

View on WordPress.org