Patreon Wordpress
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:patreon_wordpress:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Patreon Wordpress (cb0dc19d-74db-522d-b9b4-137001c46fe2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-92432 |
vulnerable | 2026-11-03 10:16:22.380352 |
Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.
Published: 2026-10-17T06:00:13.073Z
Updated: 2026-10-18T11:12:32.731Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-92433 |
vulnerable | 2026-11-03 10:16:21.566569 |
Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.
Published: 2026-10-17T06:00:12.725Z
Updated: 2026-10-18T11:12:33.034Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-92431 |
vulnerable | 2026-11-03 10:16:21.418647 |
Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
Published: 2026-10-17T06:00:12.898Z
Updated: 2026-10-18T11:12:32.885Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25026 |
vulnerable | 2026-06-08 05:30:39.823179 |
Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Published: 2022-03-14T14:41:16.000Z
Updated: 2024-08-03T19:49:14.659Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24231 |
vulnerable | 2026-06-08 05:30:04.024457 |
Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link.
Published: 2021-04-12T14:06:31.000Z
Updated: 2024-08-03T19:21:18.660Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24230 |
vulnerable | 2026-06-08 05:30:04.024134 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24229 |
vulnerable | 2026-06-08 05:30:04.023799 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24228 |
vulnerable | 2026-06-08 05:30:04.023424 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24227 |
vulnerable | 2026-06-08 05:30:04.022311 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.