Webfactory
25 CVEs across 14 Webfactory products. Browse Webfactory vulnerabilities, severities, and proof-of-concept exploits.
Webfactory products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11426 | Medium | 6.5 | 2026-07-11 | The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.76. This is due to the plugin a… |
CVE-2026-5415 | High | 8.8 | 2026-06-05 | The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication… |
CVE-2026-5411 | High | 8.8 | 2026-06-05 | The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file… |
CVE-2024-13362 | Medium | 6.1 | 2026-05-01 | Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient inp… |
CVE-2025-11707 | Medium | 5.3 | 2025-12-13 | The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key k… |
CVE-2025-10645 | Medium | 5.3 | 2025-10-07 | The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method… |
CVE-2025-23968 | Critical | 9.1 | 2025-07-03 | Unrestricted Upload of File with Dangerous Type vulnerability in WebFactory AiBud WP aibuddy-openai-chatgpt allows Upload a Web Shell to a Web Server.This issu… |
CVE-2025-3766 | Medium | 5.4 | 2025-05-07 | The Login Lockdown & Protection plugin for WordPress is vulnerable to unauthorized nonce access due to a missing capability check on the ajax_run_tool function… |
CVE-2025-2074 | Medium | 5.3 | 2025-03-28 | The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to generic SQL Injection via the ‘sSearch’ parameter in all versions up to, and including, 1.2… |
CVE-2025-1262 | Medium | 5.3 | 2025-02-25 | The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthen… |
CVE-2024-13623 | Medium | 5.9 | 2025-01-31 | The Order Export for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.24 via the 'uploa… |
CVE-2024-12034 | Medium | 5.3 | 2024-12-24 | The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not uti… |
CVE-2024-43259 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in WebFactory Order Export for WooCommerce order-export-and-more-for-woocommerce.This issue aff… |
CVE-2024-5087 | Medium | 6.3 | 2024-06-08 | The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the val… |
CVE-2024-4661 | Medium | 4.3 | 2024-06-08 | The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax function in all version… |
CVE-2024-5770 | Medium | 4.2 | 2024-06-08 | The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_sa… |
CVE-2024-0867 | High | 8.1 | 2024-05-24 | The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check_nonce function. Th… |
CVE-2023-6799 | Medium | 5.9 | 2024-04-09 | The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2… |
CVE-2024-1340 | Medium | 5.4 | 2024-02-29 | The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_exp… |
CVE-2024-1501 | Medium | 4.7 | 2024-02-21 | The Database Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.22. This is due to missing or incor… |
CVE-2024-1075 | Low | 3.7 | 2024-02-05 | The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all versions up to, and… |
CVE-2023-5062 | Medium | 6.4 | 2023-09-20 | The WordPress Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wp_charts' shortcode in versions up to, and including, 0.7.0 due to… |
CVE-2023-0832 | Medium | 4.3 | 2023-06-09 | The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incor… |
CVE-2023-0831 | Medium | 4.3 | 2023-06-09 | The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incor… |
CVE-2023-1913 | Medium | 4.4 | 2023-04-06 | The Maps Widget for Google Maps for WordPress is vulnerable to Stored Cross-Site Scripting via widget settings in versions up to, and including, 4.24 due to in… |