Webfactory vulnerabilities
34 CVEs and advisories name Webfactory as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-100518WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability
- CVE-2026-97308WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability
- CVE-2026-94457WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability
- CVE-2026-94174WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability
- CVE-2026-11426UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter
- CVE-2026-5411WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2026-5415WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link
- CVE-2024-13362Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
- CVE-2025-11707Login Lockdown & Protection <= 2.14 - IP Block Bypass
- CVE-2025-10645WP Reset <= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log
- CVE-2025-23968WordPress AiBud WP plugin <= 1.9 - Arbitrary File Upload vulnerability
- CVE-2025-3766Login Lockdown & Protection <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting
- CVE-2025-2074Advanced Google reCAPTCHA <= 1.29 - Authenticated (Subscriber+) Limited SQL Injection via 'sSearch' Parameter
- CVE-2025-1262Advanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypass
- CVE-2024-13623Order Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
- CVE-2024-12034Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock
- CVE-2024-43259WordPress Order Export for WooCommerce plugin <= 3.23 - Sensitive Data Exposure vulnerability
- CVE-2024-5087Minimal Coming Soon – Coming Soon Page <= 2.38 - Missing Authorization to Limited Settings Change
- CVE-2024-4661WP Reset <= 2.02 - Missing Authorization to License Key Modification
- CVE-2024-5770WP Force SSL & HTTPS SSL Redirect <= 1.66 - Missing Authorization to Settings Update
- CVE-2023-48745WordPress Captcha Code plugin <= 2.9 - Captcha Bypass vulnerability
- CVE-2024-0867Email Log <= 2.4.8 - Unauthenticated Hook Injection
- CVE-2023-6799WP Reset <= 2.0 - Sensitive Information Exposure due to Insufficient Randomness
- CVE-2024-1501Database Reset <= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installation
- CVE-2024-1340Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization
- CVE-2024-1075Minimal Coming Soon – Coming Soon Page <= 2.37 - Unauthenticated Maintenance Mode Bypass
- CVE-2023-50837WordPress Login Lockdown Plugin <= 2.06 is vulnerable to SQL Injection
- CVE-2023-49747WordPress Guest Author Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-5062WordPress Charts <= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2023-0832Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_install_weglot