Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: WP Fusion Lite 3.48.0 Clear all filters
TI-2026-61824 CVE-2026-90974 · GHSA-hvxw-45q7-rcv5

WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update

Priority LOW 34

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoi…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.002 Published 2026-10-01 Fixed in 3.48.0 CWE-862
TI-2026-61823 CVE-2026-90972 · GHSA-259g-3h2p-gwg5

WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion

Priority LOW 23

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-u…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00138 Published 2026-10-01 Fixed in 3.48.0 CWE-284