PatchTheCVEwp-recall vulnerabilities and fixes
Recent CVEs affecting wp-recall, with upgrade or downgrade steps. 7 tracked.
Also searched as: wp recall.
wp-recall has 7 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 7. Most recent: 2025-04-28. Highest priority: CVE-2025-1323 (score 53/100).
- CVE-2025-1325 MEDIUM 6.3 UPGRADE The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortco
- CVE-2025-1324 MEDIUM 6.4 UPGRADE The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Stored Cross-Site
- CVE-2025-1323 HIGH 7.5 UPGRADE The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via
- CVE-2025-1322 MEDIUM 4.3 UPGRADE The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Expos
- CVE-2024-9771 LOW 3.5 UPGRADE The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could
- CVE-2024-9770 MEDIUM 4.7 UPGRADE The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a
- CVE-2024-8292 CRITICAL 9.8 UPGRADE The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalat
FAQ
How do I fix wp-recall vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is wp-recall being exploited right now?
None of the tracked wp-recall CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which wp-recall CVE should I patch first?
CVE-2025-1323 currently ranks highest (53/100): The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via.