12 Step Meeting List
12 Step Meeting List has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 11 are fixed as of September 2026. Their average CVSS score is 5.7, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 2 high. 2026 was the busiest year with 4 disclosures.
The most common weakness is Cross-Site Scripting, behind 4 of the records (36%). Other recurring categories include Missing Authorization, Exposure Of Sensitive Information To An Unauthorized Actor.
Every one of the 11 issues recorded for 12 Step Meeting List has a vendor fix available, so running the current release closes all known holes.
7 independent researchers contributed these findings, most of them (2) reported by Bao - BlueRock. 12 Step Meeting List is installed on roughly 900 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2026-7833312 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored Cross-Site Scripting
Read the full analysisVulnerability Records

12 Step Meeting List
Author
AA Web Servant
This plugin helps twelve step recovery programs list their meetings. It standardizes addresses, and displays results in a searchable list and map. It’s also the easiest way for Alcoholics Anonymous service entities to get listed in the Meeting Guide mobile app for iOS and Android devices. This plugin was originally designed to maintain a list of A.A. meetings in Santa Clara County, CA. It is now used to provide meeting information for A.A. and other 12-step recovery groups around the world. Notes The Meeting Notes field is for any non-standardized meeting info, such as Basement, or Building C Location should be a simple place-name, eg Queen of the Valley Hospital Address should only be the address; no “Upstairs” or “Building C” or “Near 2nd Ave” You can fill in a very basic address and then when you tab away from that field you will see it try to standardize the address for you. If you write “1000 trancas, napa” it will replace it with “1000 Trancas St, Napa, CA 94558, USA.”
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C