Vulnerabilities

TI-2026-12212 CVE-2026-14444 · GHSA-94rx-xh7r-j5mf

WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter

LOW 35

The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00363 Published 2026-09-07 No fix listed CWE-269

TI-2026-34234 CVE-2026-46555

WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration

LOW 35

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages.

CVSS 3.1HIGH 7.7 Local No auth No interaction EPSS 0.00207 Published 2026-07-20 Fixed in 0.2.1 CWE-22

TI-2024-21350 CVE-2024-32455 · GHSA-7rq7-96m7-qr44

WordPress Fatal Error Notify plugin <= 1.5.2 - Broken Access Control vulnerability

LOW 20

Missing Authorization vulnerability in Very Good Plugins Fatal Error Notify.This issue affects Fatal Error Notify: from n/a through 1.5.2.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00296 Published 2024-04-16 No fix listed CWE-862

TI-2023-06588 CVE-2023-7202 · GHSA-wp95-g3h2-jhqf

Fatal Error Notify < 1.5.3 - Subscriber+ Test Error Email Sending

LOW 27

The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email add…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00228 Published 2024-02-27 Fixed in 1.5.3 CWE-352

TI-2021-13674 CVE-2021-34660 · GHSA-2g3c-qcgf-24jv

WP Fusion Lite <= 3.37.18 Reflected Cross-Site Scripting

LOW 29

The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the ~/includes/admin/logging/class-log-table-list.php file which allows attackers to inject arbitra…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00819 Published 2021-08-09 No fix listed CWE-79

TI-2021-13675 CVE-2021-34661 · GHSA-7xcf-8vfw-jvw5

WP Fusion Lite <= 3.37.18 Cross-Site Request Forgery to Data Deletion

LOW 28

The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/class-log-handler.php file which allows attackers to drop all log…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0045 Published 2021-08-09 No fix listed CWE-352