WordPress plugin
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 18 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High3
- Medium13
- Low0
All RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Missing Authorization ≤4.1235Update to 4.1236 | CVE-2026-125438 | |
| Medium4.3 | Missing Authorization ≤4.1235Update to 4.1236 | CVE-2026-125434 | |
| Medium6.3 | Authenticated (Technician+) Privilege Escalation ≤4.1234Update to 4.1235 | CVE-2026-119514 | |
| Medium4.3 | Authenticated (Subscriber+) Information Exposure ≤4.1226Update to 4.1227 | CVE-2026-97309 | |
| Medium6.4 | Authenticated (Customer+) Stored Cross-Site Scripting ≤4.1225Update to 4.1227 | CVE-2026-100509 | |
| High8.8 | Authenticated (Subscriber+) Remote Code Execution ≤4.1224Update to 4.1225 | CVE-2026-81803 | |
| Medium5.3 | Missing Authorization ≤4.1223Update to 4.1224 | CVE-2026-78291 | |
| Medium4.3 | Missing Authorization ≤4.1121Update to 4.1125 | CVE-2026-24638 | |
| Medium4.3 | Missing Authorization ≤4.1132Update to 4.1133 | CVE-2026-39584 | |
| Medium5.3 | Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action ≤4.1132Update to 4.1133 | CVE-2026-3567 | |
| Medium5.3 | Unauthenticated Information Exposure ≤4.1132Update to 4.1133 | CVE-2026-39586 | |
| Medium4.3 | Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders ≤4.1116Update to 4.1121 | CVE-2026-0820 | |
| Medium4.3 | Missing Authorization ≤3.8213Update to 3.8214 | CVE-2025-32277 | |
| Critical9.8 | Authenticated (Customer+) Privilege Esclation via Account Takeover ≤3.8119Update to 3.8120 | CVE-2024-56061 | |
| High8.8 | Missing Authorization to Account Takeover/Privilege Escalation ≤3.8120Update to 3.8122 | CVE-2024-12259 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤3.8115Update to 3.8116 | CVE-2024-51793 | |
| High8.8 | SQL Injection ≤3.72Update to 3.73 | — | |
| Medium6.6 | Authenticated (Admin+) Stored Cross-Site Scripting <2.0Update to 2.0 | — |
- Medium5.3Missing Authorization
≤4.1235Update to 4.1236
- Medium4.3Missing Authorization
≤4.1235Update to 4.1236
- Medium6.3Authenticated (Technician+) Privilege Escalation
≤4.1234Update to 4.1235
- Medium4.3Authenticated (Subscriber+) Information Exposure
≤4.1226Update to 4.1227
- Medium6.4Authenticated (Customer+) Stored Cross-Site Scripting
≤4.1225Update to 4.1227
- High8.8Authenticated (Subscriber+) Remote Code Execution
≤4.1224Update to 4.1225
- Medium5.3Missing Authorization
≤4.1223Update to 4.1224
- Medium4.3Missing Authorization
≤4.1121Update to 4.1125
- Medium4.3Missing Authorization
≤4.1132Update to 4.1133
- Medium5.3Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action
≤4.1132Update to 4.1133
- Medium5.3Unauthenticated Information Exposure
≤4.1132Update to 4.1133
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders
≤4.1116Update to 4.1121
- Medium4.3Missing Authorization
≤3.8213Update to 3.8214
- Critical9.8Authenticated (Customer+) Privilege Esclation via Account Takeover
≤3.8119Update to 3.8120
- High8.8Missing Authorization to Account Takeover/Privilege Escalation
≤3.8120Update to 3.8122
- Critical9.8Unauthenticated Arbitrary File Upload
≤3.8115Update to 3.8116
- High8.8SQL Injection
≤3.72Update to 3.73
- Medium6.6Authenticated (Admin+) Stored Cross-Site Scripting
<2.0Update to 2.0
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress: common questions
Does RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress have known vulnerabilities?
Yes. VulnCrest Radar lists 18 known vulnerabilities in RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress: 2 critical, 3 high, 13 medium. None are known to affect version null.
How do I check which version of RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress vulnerability?
CVE-2026-125438, published Nov 11, 2026: RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1235 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress vulnerability listed in CISA KEV?
No. None of the known RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress vulnerabilities is currently listed in the CISA KEV catalog.