WordPress plugin
Passwords Manager security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 4 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium2
- Low0
All Passwords Manager vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Unauthenticated SQL Injection ≤1.4.8Update to 1.5.1 | CVE-2024-12613 | |
| High7.5 | Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key ≤1.4.8Update to 1.5.1 | CVE-2024-12614 | |
| Medium6.5 | Authenticated (Subscriber+) SQL Injection ≤1.4.8Update to 1.5.1 | CVE-2024-12615 | |
| Medium5.5 | Cross-Site Scripting via pwdms_csv_category parameter ≤1.4.4Update to 1.4.5 | — |
- High7.5Unauthenticated SQL Injection
≤1.4.8Update to 1.5.1
- High7.5Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key
≤1.4.8Update to 1.5.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤1.4.8Update to 1.5.1
- Medium5.5Cross-Site Scripting via pwdms_csv_category parameter
≤1.4.4Update to 1.4.5
Passwords Manager: common questions
Does Passwords Manager have known vulnerabilities?
Yes. VulnCrest Radar lists 4 known vulnerabilities in Passwords Manager: 2 high, 2 medium. None are known to affect version null.
How do I check which version of Passwords Manager I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Passwords Manager vulnerability?
CVE-2024-12613, published Jan 15, 2025: Passwords Manager <= 1.4.8 - Unauthenticated SQL Injection. Severity: High (CVSS 7.5).
Is any Passwords Manager vulnerability listed in CISA KEV?
No. None of the known Passwords Manager vulnerabilities is currently listed in the CISA KEV catalog.