Plugins · contentstudio · data as of 2026-11-04
Is ContentStudio safe? Known vulnerabilities and latest version
- Latest version
- 1.4.1
- Last updated
- 2025-12-08
- Active installs
- 600+
- Known issues on record
- 8
- Unpatched in latest
- 0
- Tested up to WP
- 6.9.11 · PHP 7.4+
Streamline Your Social Media and Content Marketing — by contentstudio
What to do
- Update to the latest version (1.4.1). Anything older than 1.4.0 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get contentstudio --field=version shows what you run; wp plugin update contentstudio updates it.
Check your version
Known vulnerabilities
8 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
critical 9.1 CVE-2025-67910 · published 2026-01-08
Arbitrary file upload in ContentStudio (1.3.7 and older)
- Affected
- 1.3.7 and older
- Fixed in
- 1.4.0
- Access needed (per CVSS)
- Needs an admin-level account
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue affects Contentstudio: from n/a through <= 1.3.7.
medium 4.3 CVE-2025-13144 · published 2025-12-05
Cross-site request forgery (CSRF) in ContentStudio (1.3.7 and older)
- Affected
- 1.3.7 and older
- Fixed in
- 1.4.0 *
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The ContentStudio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.7. This is due to missing or insufficient nonce validation on the add_cstu_settings function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD CVE-2025-13144Wordfence advisoryCode change (fix)Plugin source
high 8.8 CVE-2025-12181 · published 2025-12-05
Arbitrary file upload in ContentStudio (1.3.7 and older)
- Affected
- 1.3.7 and older
- Fixed in
- 1.4.0 *
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstu_update_post() function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2025-67910 is likely a duplicate of this.
NVD CVE-2025-12181Wordfence advisoryCode change (fix)wordpress.org
medium 5.3 CVE-2025-49990 · published 2025-06-20
Missing authorization check in ContentStudio (1.3.7 and older)
- Affected
- 1.3.7 and older
- Fixed in
- 1.4.0
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contentstudio: from n/a through <= 1.3.7.
medium 4.3 CVE-2025-47692 · published 2025-05-07
Missing authorization check in ContentStudio (1.3.5 and older)
- Affected
- 1.3.5 and older
- Fixed in
- 1.3.7
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contentstudio: from n/a through <= 1.3.5.
medium 6.5 CVE-2023-0556 · published 2023-01-27
Missing authorization check in ContentStudio (1.2.5 and older)
- Affected
- 1.2.5 and older
- Fixed in
- 1.2.6 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating.
NVD CVE-2023-0556Wordfence advisoryCode change (fix)Plugin source
medium 5.3 CVE-2023-0557 · published 2023-01-27
Information disclosure in ContentStudio (1.2.5 and older)
- Affected
- 1.2.5 and older
- Fixed in
- 1.2.6 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts.
NVD CVE-2023-0557Wordfence advisoryCode change (fix)Plugin source
critical 9.8 CVE-2023-0558 · published 2023-01-27
Missing authorization check in ContentStudio (1.2.5 and older)
- Affected
- 1.2.5 and older
- Fixed in
- 1.2.6 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions intended for use by users with proper API keys.
Recent activity
- 2025-12-08 — latest release on wordpress.org (1.4.1).
- 2026-01-08 — Arbitrary file upload disclosed (CVE-2025-67910), fixed in 1.4.0.
- 2025-12-05 — Cross-site request forgery (CSRF) disclosed (CVE-2025-13144), fixed in 1.4.0.
- 2025-12-05 — Arbitrary file upload disclosed (CVE-2025-12181), fixed in 1.4.0.
Get an email when ContentStudio has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for ContentStudio (contentstudio) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
Types found in this plugin: Missing authorization (4) · Arbitrary file upload (2) · Cross-site request forgery (CSRF) (1) · Sensitive data exposure (1)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/contentstudio (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/contentstudio"><img src="https://laskyr.com/plugins/contentstudio/badge.svg" alt="ContentStudio vulnerability status"></a>