Zippy

Zippy has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2024; 4 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 3 high. 2023 was the busiest year with 3 disclosures.

The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 2 of the records (40%). Other recurring categories include Deserialization Of Untrusted Data, Exposure Of Sensitive Information To An Unauthorized Actor.

4 of the records (80%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2024.

5 independent researchers contributed these findings, one record each. Zippy is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSMedium

6.5/ 10

Patch Coverage80%

Open

Fixed

Get automatic notifications for all Zippy vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2025-52758

Zippy <= 1.7.0 - Authenticated (Editor+) Arbitrary File Upload

Read the full analysis

Vulnerability Records

5 records


2024-08-27 00:00	Zippy <= 1.7.0 - Authenticated (Editor+) Arbitrary File Upload Zippy <= 1.7.0	`CVE-2025-52758`	7.2 High	63n0	No
2024-03-13 00:00	Zippy <= 1.6.9 - Authenticated (Editor+) Arbitrary File Upload Zippy <= 1.6.9	`CVE-2024-27964`	7.2 High	stealthcopter	Yes
2023-07-12 00:00	Zippy <= 1.6.2 - Missing Authorization via adminInit Zippy <= 1.6.2	`CVE-2023-34381`	6.5 Medium	Emili Castells	Yes
2023-06-28 00:00	Zippy <= 1.6.5 - Authenticated(Author+) PHP Object Injection via unzipPosts Zippy <= 1.6.5	`CVE-2023-36381`	7.5 High	Jeong Seong Ho	Yes
2023-03-30 00:00	Zippy <= 1.6.1 - Authenticated (Contributor+) Sensitive Information Disclosure Zippy <= 1.6.1	`CVE-2023-26533`	4.3 Medium	Junsu Yeo	Yes

Showing 1–5 of 5 reports

Latestv1.7.0

Zippy

Author

Gesundheit Bewegt GmbH

4.6(16)

92/100

Last Updated

2025-09-30 (1y ago)

Active Installs

8,000+

Downloads

234,356

Requires WP

4.9+

Requires PHP

Tested up to

WP 6.8.8

Created

2016-10-12 (10y ago)

Incredibly easy solution to archive pages and posts as zip file and unpack them back even on the other website! Archive posts and pages in one click. Transfer them to the other website or simple use this feature to backup you articles on the local computer. Important Please make sure Zip extension is enabled on your web server! Otherwise, the plugin will not work for you. More info: https://www.php.net/manual/en/book.zip.php Features: archive posts as zip-files extract archives on any website with the installed plugin download and store posts as zip archives multiple posts support custom post types support

View on WordPress.org