Zoho Flow vulnerabilities

Products

• Zoho Flow 4

Latest Zoho Flow CVEs

Newest publication first

1. CVE-2026-62131 WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

   Published 2026-10-29

   Critical·CVSS 9.8 EPSS 0.31%

   Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

2. CVE-2025-59568 WordPress Zoho Flow Plugin <= 2.14.1 - Cross Site Request Forgery (CSRF) Vulnerability

   Published 2025-09-22

   Medium·CVSS 4.3 EPSS 0.14%

   Cross-Site Request Forgery (CSRF) vulnerability in Zoho Flow Zoho Flow zoho-flow allows Cross Site Request Forgery.This issue affects Zoho Flow: from n/a through <= 2.14.1.

3. CVE-2025-31408 WordPress Zoho Flow plugin <= 2.13.3 - Broken Access Control vulnerability

   Published 2025-04-01

   Medium·CVSS 4.3 EPSS 0.25%

   Missing Authorization vulnerability in Zoho Flow Zoho Flow zoho-flow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho Flow: from n/a through <= 2.13.3.

4. CVE-2024-47334 WordPress Zoho Flow for WordPress plugin <= 2.7.1 - SQL Injection vulnerability

   Published 2024-10-09

   High·CVSS 7.6 EPSS 0.42%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Flow Zoho Flow zoho-flow allows SQL Injection.This issue affects Zoho Flow: from n/a through <= 2.7.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.