Nelio Software vulnerabilities

Products

• Nelio Content 5
• Nelio AB Testing 4
• Nelio Popups 2

Latest Nelio Software CVEs

Newest publication first

1. CVE-2026-57648 WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability

   Published 2026-06-26

   Medium·CVSS 4.3 EPSS 0.25%

   Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.

2. CVE-2026-40742 WordPress Nelio AB Testing plugin <= 8.2.8 - Sensitive Data Exposure vulnerability

   Published 2026-04-15

   Medium·CVSS 5.3 EPSS 0.19%

   Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio AB Testing: from n/a through <= 8.2.8.

3. CVE-2026-39521 WordPress Nelio Content plugin <= 4.3.1 - Server Side Request Forgery (SSRF) vulnerability

   Published 2026-04-08

   Medium·CVSS 4.9 EPSS 0.15%

   Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content nelio-content allows Server Side Request Forgery.This issue affects Nelio Content: from n/a through <= 4.3.1.

4. CVE-2026-32573 WordPress Nelio AB Testing plugin <= 8.2.7 - Remote Code Execution (RCE) vulnerability

   Published 2026-03-25

   Critical·CVSS 9.1 EPSS 0.31%

   Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.7.

5. CVE-2026-25378 WordPress Nelio AB Testing plugin <= 8.2.4 - SQL Injection vulnerability

   Published 2026-02-19

   High·CVSS 7.6 EPSS 0.40%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Blind SQL Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.4.

6. CVE-2026-25016 WordPress Nelio Popups plugin <= 1.3.5 - Broken Access Control vulnerability

   Published 2026-02-03

   Medium·CVSS 4.3 EPSS 0.18%

   Missing Authorization vulnerability in Nelio Software Nelio Popups nelio-popups allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Popups: from n/a through <= 1.3.5.

7. CVE-2026-24572 WordPress Nelio Content plugin <= 4.2.0 - SQL Injection vulnerability

   Published 2026-01-23

   High·CVSS 8.5 EPSS 0.36%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio Content nelio-content allows Blind SQL Injection.This issue affects Nelio Content: from n/a through <= 4.2.0.

8. CVE-2025-67944 WordPress Nelio AB Testing plugin <= 8.1.8 - Arbitrary Code Execution vulnerability

   Published 2026-01-22

   Critical·CVSS 9.1 EPSS 0.58%

   Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through <= 8.1.8.

9. CVE-2025-66111 WordPress Nelio Popups plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

   Published 2025-11-21

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nelio Software Nelio Popups nelio-popups allows Stored XSS.This issue affects Nelio Popups: from n/a through <= 1.3.0.

10. CVE-2025-62927 WordPress Nelio Content plugin <= 4.0.5 - Broken Access Control vulnerability

    Published 2025-10-27

    Medium·CVSS 6.5 EPSS 0.33%

    Missing Authorization vulnerability in Nelio Software Nelio Content nelio-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Content: from n/a through <= 4.0.5.

11. CVE-2024-30531 WordPress Nelio Content plugin <= 3.2.0 - Server Side Request Forgery (SSRF) vulnerability

    Published 2024-04-02

    Medium·CVSS 4.9 EPSS 0.27%

    Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content.This issue affects Nelio Content: from n/a through 3.2.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.