Read the docs

Patreon

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

Patreon records in CISA KEV

No Patreon vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Patreon Wordpress 8 records MEDIUM Flutter Downloader 1 record HIGH

Records

8 records in Patreon Wordpress · all components

TI-2021-06520 CVE-2021-24228 · GHSA-3g9j-v8wq-8c77

Patreon WordPress < 1.7.2 - Reflected XSS on Login Form

Priority MEDIUM 45

The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01874 Published 2021-04-12 Fixed in 1.7.2 CWE-79
TI-2021-06519 CVE-2021-24227 · GHSA-cc3j-r9g7-4r8c

Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure

Priority MEDIUM 42

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06755 Published 2021-04-12 Fixed in 1.7.0 CWE-200
TI-2021-06522 CVE-2021-24230 · GHSA-9pr2-6qr7-7436

Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User Meta

Priority LOW 36

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the vic…

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00598 Published 2021-04-12 Fixed in 1.7.0 CWE-352
TI-2021-06523 CVE-2021-24231 · GHSA-hhg9-2j57-c5cj

Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon

Priority LOW 30

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a s…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00575 Published 2021-04-12 Fixed in 1.7.0 CWE-352
TI-2021-07304 CVE-2021-25026 · GHSA-84ph-h2vc-8hrg

Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting

Priority LOW 26

The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html ca…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00699 Published 2022-03-14 Fixed in 1.8.2 CWE-79
Open these records in search →