# cve.now: Webfactory

The newest entries naming Webfactory as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-100518](https://cve.now/CVE-2026-100518.md): WordPress Advanced Google reCAPTCHA plugin \<= 5.40 - Broken Authentication vulnerability (CVSS 5.3)
- [CVE-2026-97308](https://cve.now/CVE-2026-97308.md): WordPress Login Lockdown plugin \<= 2.17 - Bypass Vulnerability vulnerability (CVSS 4.8)
- [CVE-2026-94457](https://cve.now/CVE-2026-94457.md): WordPress Captcha Code plugin \<= 3.32 - Bypass Vulnerability vulnerability (CVSS 4.8)
- [CVE-2026-94174](https://cve.now/CVE-2026-94174.md): WordPress Email Log plugin \<= 2.63 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-11426](https://cve.now/CVE-2026-11426.md): UnderConstructionPage PRO \<= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template\_thumbnail Parameter (CVSS 6.5)
- [CVE-2026-5411](https://cve.now/CVE-2026-5411.md): WP Captcha PRO \<= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2026-5415](https://cve.now/CVE-2026-5415.md): WP Captcha PRO \<= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link (CVSS 8.8)
- [CVE-2024-13362](https://cve.now/CVE-2024-13362.md): Freemius \<= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
- [CVE-2025-11707](https://cve.now/CVE-2025-11707.md): Login Lockdown & Protection \<= 2.14 - IP Block Bypass (CVSS 5.3)
- [CVE-2025-10645](https://cve.now/CVE-2025-10645.md): WP Reset \<= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log (CVSS 5.3)
- [CVE-2025-23968](https://cve.now/CVE-2025-23968.md): WordPress AiBud WP plugin \<= 1.9 - Arbitrary File Upload vulnerability (CVSS 9.1)
- [CVE-2025-3766](https://cve.now/CVE-2025-3766.md): Login Lockdown & Protection \<= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting (CVSS 5.4)
- [CVE-2025-2074](https://cve.now/CVE-2025-2074.md): Advanced Google reCAPTCHA \<= 1.29 - Authenticated (Subscriber+) Limited SQL Injection via 'sSearch' Parameter (CVSS 5.3)
- [CVE-2025-1262](https://cve.now/CVE-2025-1262.md): Advanced Google reCaptcha \<= 1.27 - Built-in Math CAPTCHA Bypass (CVSS 5.3)
- [CVE-2024-13623](https://cve.now/CVE-2024-13623.md): Order Export for WooCommerce \<= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 5.9)
- [CVE-2024-12034](https://cve.now/CVE-2024-12034.md): Advanced Google reCAPTCHA \<= 1.25 - Brute Force Protection IP Unblock (CVSS 5.3)
- [CVE-2024-43259](https://cve.now/CVE-2024-43259.md): WordPress Order Export for WooCommerce plugin \<= 3.23 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2024-5087](https://cve.now/CVE-2024-5087.md): Minimal Coming Soon – Coming Soon Page \<= 2.38 - Missing Authorization to Limited Settings Change (CVSS 6.3)
- [CVE-2024-4661](https://cve.now/CVE-2024-4661.md): WP Reset \<= 2.02 - Missing Authorization to License Key Modification (CVSS 4.3)
- [CVE-2024-5770](https://cve.now/CVE-2024-5770.md): WP Force SSL & HTTPS SSL Redirect \<= 1.66 - Missing Authorization to Settings Update (CVSS 4.2)
- [CVE-2023-48745](https://cve.now/CVE-2023-48745.md): WordPress Captcha Code plugin \<= 2.9 - Captcha Bypass vulnerability (CVSS 5.3)
- [CVE-2024-0867](https://cve.now/CVE-2024-0867.md): Email Log \<= 2.4.8 - Unauthenticated Hook Injection (CVSS 8.1)
- [CVE-2023-6799](https://cve.now/CVE-2023-6799.md): WP Reset \<= 2.0 - Sensitive Information Exposure due to Insufficient Randomness (CVSS 5.9)
- [CVE-2024-1501](https://cve.now/CVE-2024-1501.md): Database Reset \<= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installation (CVSS 4.7)
- [CVE-2024-1340](https://cve.now/CVE-2024-1340.md): Login Lockdown – Protect Login Form \<= 2.08 - Missing Authorization (CVSS 5.4)
- [CVE-2024-1075](https://cve.now/CVE-2024-1075.md): Minimal Coming Soon – Coming Soon Page \<= 2.37 - Unauthenticated Maintenance Mode Bypass (CVSS 3.7)
- [CVE-2023-50837](https://cve.now/CVE-2023-50837.md): WordPress Login Lockdown Plugin \<= 2.06 is vulnerable to SQL Injection (CVSS 7.6)
- [CVE-2023-49747](https://cve.now/CVE-2023-49747.md): WordPress Guest Author Plugin \<= 2.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2023-5062](https://cve.now/CVE-2023-5062.md): WordPress Charts \<= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2023-0832](https://cve.now/CVE-2023-0832.md): Under Construction \<= 3.96 - Cross-Site Request Forgery via admin\_action\_install\_weglot (CVSS 4.3)
- [CVE-2023-0831](https://cve.now/CVE-2023-0831.md): Under Construction \<= 3.96 - Cross-Site Request Forgery via admin\_action\_ucp\_dismiss\_notice (CVSS 4.3)
- [CVE-2023-1913](https://cve.now/CVE-2023-1913.md): Maps Widget for Google Maps \<= 4.24 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2021-36909](https://cve.now/CVE-2021-36909.md): WordPress WP Reset PRO Premium plugin \<= 5.98 - Authenticated Database Reset vulnerability (CVSS 8.8)
- [CVE-2021-36908](https://cve.now/CVE-2021-36908.md): WordPress WP Reset PRO Premium Plugin \<= 5.98 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/webfactory
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.