Read the docs

Patreon

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

Patreon records in CISA KEV

No Patreon vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Patreon Wordpress 8 records MEDIUM Flutter Downloader 1 record HIGH

Records

13 records

TI-2021-06520 CVE-2021-24228 · GHSA-3g9j-v8wq-8c77

Patreon WordPress < 1.7.2 - Reflected XSS on Login Form

Priority MEDIUM 45

The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01874 Published 2021-04-12 Fixed in 1.7.2 CWE-79
TI-2021-06519 CVE-2021-24227 · GHSA-cc3j-r9g7-4r8c

Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure

Priority MEDIUM 42

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06755 Published 2021-04-12 Fixed in 1.7.0 CWE-200
TI-2026-71227 CVE-2026-108479 · GHSA-8qcf-hj98-q7c6

Cross-site request forgery in Patreon WordPress plugin

Priority LOW 36

Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00128 Published 2026-10-12 No fix listed CWE-352
TI-2025-18305 CVE-2025-24588 · GHSA-3v34-886r-p598

WordPress Patreon WordPress plugin <= 1.9.1 - Broken Access Control vulnerability

Priority LOW 36

Missing Authorization vulnerability in patreon Patreon WordPress patreon-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Patreon WordPress: from n/a through <= 1.9.1.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00536 Published 2025-01-24 No fix listed CWE-862
TI-2021-06522 CVE-2021-24230 · GHSA-9pr2-6qr7-7436

Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User Meta

Priority LOW 36

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the vic…

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00598 Published 2021-04-12 Fixed in 1.7.0 CWE-352
TI-2026-71228 CVE-2026-108481 · GHSA-x8gf-gx27-w64x

Cross-site request forgery in Patreon WordPress plugin

Priority LOW 31

Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00116 Published 2026-10-12 No fix listed CWE-352
TI-2021-06523 CVE-2021-24231 · GHSA-hhg9-2j57-c5cj

Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon

Priority LOW 30

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a s…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00575 Published 2021-04-12 Fixed in 1.7.0 CWE-352
TI-2021-07304 CVE-2021-25026 · GHSA-84ph-h2vc-8hrg

Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting

Priority LOW 26

The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html ca…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00699 Published 2022-03-14 Fixed in 1.8.2 CWE-79
Open these records in search →