WordPress plugin
Patreon WordPress security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 15 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High3
- Medium9
- Low0
All Patreon WordPress vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.7 | Unauthenticated Open Redirect ≤1.9.0Update to 1.10.0 | CVE-2026-92432 | |
| Medium5.3 | Missing Authorization ≤1.9.0Update to 1.10.0 | CVE-2026-92431 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.9.0Update to 1.10.0 | CVE-2026-92433 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.9.17Update to 1.10.0 | CVE-2026-108479 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.10.0Update to 1.11.0 | CVE-2026-108481 | |
| Medium5.3 | Missing Authorization ≤1.9.1Update to 1.9.2 | CVE-2025-24588 | |
| Medium5.3 | Protection Mechanism Bypass ≤1.9.0Update to 1.9.1 | CVE-2024-37430 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.8.7Update to 1.8.8 | CVE-2023-41129 | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting <1.8.2Update to 1.8.2 | CVE-2021-25026 | |
| Critical9.6 | Reflected Cross-Site Scripting <1.7.2Update to 1.7.2 | CVE-2021-24229 | |
| High8.8 | Cross-Site Request Forgery ≤1.6.9Update to 1.7.0 | CVE-2021-24231 | |
| Critical9.6 | Reflected Cross-Site Scripting <1.7.2Update to 1.7.2 | CVE-2021-24228 | |
| High7.5 | Local File Disclosure <1.7.0Update to 1.7.0 | CVE-2021-24227 | |
| High8.1 | Cross-Site Request Forgery <1.7.0Update to 1.7.0 | CVE-2021-24230 | |
| Critical9.8 | PHP Object Injection <1.2.2Update to 1.2.2 | CVE-2018-20984 |
- Medium4.7Unauthenticated Open Redirect
≤1.9.0Update to 1.10.0
- Medium5.3Missing Authorization
≤1.9.0Update to 1.10.0
- Medium4.3Cross-Site Request Forgery
≤1.9.0Update to 1.10.0
- Medium4.3Cross-Site Request Forgery
≤1.9.17Update to 1.10.0
- Medium4.3Cross-Site Request Forgery
≤1.10.0Update to 1.11.0
- Medium5.3Missing Authorization
≤1.9.1Update to 1.9.2
- Medium5.3Protection Mechanism Bypass
≤1.9.0Update to 1.9.1
- Medium4.3Cross-Site Request Forgery
≤1.8.7Update to 1.8.8
- Medium5.5Authenticated Stored Cross-Site Scripting
<1.8.2Update to 1.8.2
- Critical9.6Reflected Cross-Site Scripting
<1.7.2Update to 1.7.2
- High8.8Cross-Site Request Forgery
≤1.6.9Update to 1.7.0
- Critical9.6Reflected Cross-Site Scripting
<1.7.2Update to 1.7.2
- High7.5Local File Disclosure
<1.7.0Update to 1.7.0
- High8.1Cross-Site Request Forgery
<1.7.0Update to 1.7.0
- Critical9.8PHP Object Injection
<1.2.2Update to 1.2.2
Patreon WordPress: common questions
Does Patreon WordPress have known vulnerabilities?
Yes. VulnCrest Radar lists 15 known vulnerabilities in Patreon WordPress: 3 critical, 3 high, 9 medium. None are known to affect version null.
How do I check which version of Patreon WordPress I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Patreon WordPress vulnerability?
CVE-2026-92432, published Oct 14, 2026: Patreon WordPress <= 1.9.0 - Unauthenticated Open Redirect. Severity: Medium (CVSS 4.7).
Is any Patreon WordPress vulnerability listed in CISA KEV?
No. None of the known Patreon WordPress vulnerabilities is currently listed in the CISA KEV catalog.