Soflyy vulnerabilities
Published CVEs affecting Soflyy products: 4 record(s), with severity, exploitation and fixes.
CVE-2026-65551
High · 7.5
CWE-862 Aug 6, 2026
WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Breakdance: from n/a before 2.7.
CVE-2026-57735
High · 7.1
CWE-79 Jul 23, 2026
WordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.
CVE-2025-53237
High · 7.1
CWE-79 Feb 20, 2026
WordPress WP Wizard Cloak Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Wizard Cloak wp-wizard-cloak allows Reflected XSS.This issue affects WP Wizard Cloak: from n/a through <= 1.0.1.
CVE-2026-1582
Low · 3.7
CWE-200 Feb 18, 2026
WP All Export <= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Juggling
The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download endpoint. This is due to a PHP type juggling vulnerability in the security token comparison which uses loose comparison (==) instead of strict comparison (===). This makes it possible for unauthenticated attackers to bypass authentication using "magic hash" values when the expected MD5 hash prefix happens to be numeric-looking (matching pattern ^0e\d+$), allowing download of sensitive export files containing PII, business data, or database information.