Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2023-23992

WordPress AutomatorWP Plugin <= 2.5.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in AutomatorWP plugin <= 2.5.0 leads to object delete.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Automatorwp
Products
Automatorwp
CVE-2025-68561

WordPress AutomatorWP plugin <= 5.2.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia AutomatorWP automatorwp allows SQL Injection.This issue affects AutomatorWP: from n/a through <= 5.2.4.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Automatorwp Wordpress
Products
Automatorwp Wordpress
CVE-2025-9542

AutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple plugin's functions in all versions up to, and including, 5.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify integration settings or view existing automations.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Automatorwp Wordpress
Products
Automatorwp Wordpress
CVE-2025-9539

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwp_ajax_import_automation_from_url function in all versions up to, and including, 5.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary automations, which can lead to Remote Code Execution or Privilege escalation once such automation is activated by the administrator

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Automatorwp Wordpress
Products
Automatorwp Wordpress
CVE-2021-24717

AutomatorWP < 1.7.6 - Missing Authorization and Privilege Escalation

The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Automatorwp
Products
Automatorwp