WordPress plugin
Brevo for WooCommerce security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 3 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium1
- Low0
All Brevo for WooCommerce vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.0.49Update to 4.0.50 | CVE-2025-14436 | |
| High7.2 | Authenticated (Editor+) Arbitrary File Download and Deletion ≤4.0.17Update to 4.0.18 | CVE-2024-32807 |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.0.49Update to 4.0.50
- High7.2Authenticated (Editor+) Arbitrary File Download and Deletion
≤4.0.17Update to 4.0.18
Brevo for WooCommerce: common questions
Does Brevo for WooCommerce have known vulnerabilities?
Yes. VulnCrest Radar lists 3 known vulnerabilities in Brevo for WooCommerce: 2 high, 1 medium. None are known to affect version null.
How do I check which version of Brevo for WooCommerce I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Brevo for WooCommerce vulnerability?
CVE-2025-14436, published Jan 8, 2026: Brevo for WooCommerce <= 4.0.49 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any Brevo for WooCommerce vulnerability listed in CISA KEV?
No. None of the known Brevo for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.