← WordPress Vulnerabilities
WordPress security by component

WP-Recall

WP-Recall is a WordPress component with 16 published CVE records in this archive. The latest tracked vulnerability was published Jul 04, 2025; the highest CVE/CNA score is 9.8.

Plugin slug: wp-recall

CVE-2025-52796: WP-Recall: Cross-site scripting

WP-Recall is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

PublishedJul 04, 2025
Safe version guidanceSee mitigation notes
Safe version
Jul 04, 2025 CVE-2025-52796
WP-Recall: Cross-site scripting
WP-Recall is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE7.1
NVDPending
Jun 20, 2025 CVE-2025-49991
WP-Recall: A security weakness
WP-Recall is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVDPending
Jun 06, 2025 CVE-2025-30981
WP-Recall: Privilege escalation or authentication bypass
WP-Recall is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
See mitigation notes
CVE6.3
NVDPending
May 07, 2025 CVE-2025-47653
WP-Recall: Filesystem traversal
WP-Recall is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
See mitigation notes
CVE7.5
NVDPending
Apr 28, 2025 CVE-2024-9771
WP-Recall: Cross-site scripting
WP-Recall is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE3.5
NVDPending
Mar 25, 2025 CVE-2024-9770
WP-Recall: SQL injection
WP-Recall is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE4.7
NVDPending
Mar 08, 2025 CVE-2025-1325
WP-Recall – Registration, Profile, Commerce & More: A security weakness
WP-Recall – Registration, Profile, Commerce & More is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE6.3
NVD6.3
Mar 08, 2025 CVE-2025-1324
WP-Recall – Registration, Profile, Commerce & More: Cross-site scripting
WP-Recall – Registration, Profile, Commerce & More is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.4
NVD5.4
Mar 08, 2025 CVE-2025-1323
WP-Recall – Registration, Profile, Commerce & More: SQL injection
WP-Recall – Registration, Profile, Commerce & More is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE7.5
NVD9.8
Mar 08, 2025 CVE-2025-1322
WP-Recall – Registration, Profile, Commerce & More: A security weakness
WP-Recall – Registration, Profile, Commerce & More is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVD4.3
Sep 06, 2024 CVE-2024-8292
WP-Recall – Registration, Profile, Commerce & More: Privilege escalation or authentication bypass
WP-Recall – Registration, Profile, Commerce & More is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.
See mitigation notes
CVE9.8
NVDPending
Jun 08, 2024 CVE-2024-35657
WP-Recall: Cross-site request forgery
WP-Recall is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE5.4
NVDPending
Jun 06, 2024 CVE-2024-1175
WP-Recall – Registration, Profile, Commerce & More: A security weakness
WP-Recall – Registration, Profile, Commerce & More is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVD5.3
Apr 24, 2024 CVE-2024-32710
WP-Recall: SQL injection
WP-Recall is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE8.5
NVDPending
Apr 24, 2024 CVE-2024-32709
WP-Recall: SQL injection
WP-Recall is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE9.3
NVDPending
Apr 18, 2024 CVE-2024-32604
WP-Recall: A security weakness
WP-Recall is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVDPending