Plugin icon

WP-Recall – Registration, Profile, Commerce & More

wp-recall
Plugin closed

Vulnerabilities:

17

Last Updated:

March 17, 2025

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2025-06-26
Title
WP-Recall <= 16.26.14 - Reflected Cross-Site Scripting
Fixed in
No known fix
CVSS
6.1 (medium)
Published
2025-06-19
Title
WP-Recall <= 16.26.14 - Missing Authorization
Fixed in
No known fix
CVSS
5.3 (medium)
Published
2025-06-05
Title
WP-Recall <= 16.26.14 - Cross-Site Request Forgery
Fixed in
No known fix
CVSS
4.3 (medium)
Published
2025-05-07
Title
WP-Recall <= 16.26.14 - Authenticated (Contributor+) Local File Inclusion
Fixed in
No known fix
CVSS
8.8 (high)
Published
2025-04-07
Title
WP-Recall < 16.26.12 - Admin+ Stored XSS
Fixed in
Fixed in 16.26.12
CVSS
3.5 (low)
Published
2025-03-07
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.12 - Unauthenticated SQL Injection
Fixed in
Fixed in 16.26.12
CVSS
7.5 (high)
Published
2025-03-07
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Exeuction
Fixed in
Fixed in 16.26.12
CVSS
6.3 (medium)
Published
2025-03-07
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.12 - Authenticated (Contributor+) Protected Post Disclosure
Fixed in
Fixed in 16.26.12
CVSS
4.3 (medium)
Published
2025-03-07
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 16.26.12
CVSS
6.4 (medium)
Published
2025-03-04
Title
WP-Recall < 16.26.12 - Admin+ SQL Injection
Fixed in
Fixed in 16.26.12
CVSS
4.7 (medium)
Published
2024-09-05
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.9 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update
Fixed in
Fixed in 16.26.9
CVSS
9.8 (critical)
Published
2024-06-05
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.7 - Unauthenticated Payment Deletion via delete_payment
Fixed in
Fixed in 16.26.7
CVSS
5.3 (medium)
Published
2024-06-03
Title
WP-Recall < 16.26.7 - Cross-Site Request Forgery
Fixed in
Fixed in 16.26.7
CVSS
4.3 (medium)
Published
2024-04-22
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.6 - Unauthenticated SQL Injection
Fixed in
Fixed in 16.26.6
CVSS
10 (critical)
Published
2024-04-22
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.6 - Authenticated (Contributor+) SQL Injection
Fixed in
Fixed in 16.26.6
CVSS
9.9 (critical)
Published
2024-04-16
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.6 - Insecure Direct Object Reference
Fixed in
Fixed in 16.26.6
CVSS
4.3 (medium)
Published
2021-10-05
Title
WP-Recall < 16.24.48 - Reflected Cross-Site Scripting
Fixed in
Fixed in 16.24.48
CVSS
7.5 (high)