Ludwig You vulnerabilities
Published CVEs affecting Ludwig You products: 4 record(s), with severity, exploitation and fixes.
WPMasterToolKit 2QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly 1WPMasterToolKit (WPMTK) – All in one plugin 1
CVE-2026-66624
High · 7.6
CWE-89 Sep 17, 2026
WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability
Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.
CVE-2026-42756
Critical · 9.9
CWE-22 May 27, 2026
WordPress QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly plugin <= 3.2.7 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly quickwebp allows Path Traversal.This issue affects QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly: from n/a through <= 3.2.7.
CVE-2026-24388
Medium · 4.3
CWE-862 Jan 22, 2026
WordPress WPMasterToolKit plugin <= 2.14.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMasterToolKit: from n/a through <= 2.14.0.
CVE-2025-14166
Medium · 5.3
CWE-94 Dec 12, 2025
WPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection
The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0. This is due to the plugin allowing Author-level users to create and execute arbitrary PHP code through the Code Snippets feature without proper capability checks. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server, leading to remote code execution, privilege escalation, and complete site compromise.