ActiveCampaign – The autonomous marketing platform

ActiveCampaign – The autonomous marketing platform has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2025; all 4 are fixed as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 2 of the records (50%). Other recurring categories include Cross-Site Request Forgery (CSRF), Server-Side Request Forgery (SSRF).

Every one of the 4 issues recorded for ActiveCampaign – The autonomous marketing platform has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. ActiveCampaign – The autonomous marketing platform is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSMedium

5.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all ActiveCampaign – The autonomous marketing platform vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2023-0233

ActiveCampaign – Forms, Site Tracking, Live Chat <= 8.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

4 records


2025-04-04 00:00	ActiveCampaign <= 8.1.16 - Authenticated (Administrator+) Stored Cross-Site Scripting ActiveCampaign <= 8.1.16	`CVE-2025-32136`	4.4 Medium	b4orvn	Yes
2024-04-12 00:00	ActiveCampaign <= 8.1.14 - Authenticated (Administrator+) Server-Side Request Forgery ActiveCampaign <= 8.1.14	`CVE-2024-32430`	5.5 Medium	Yuchen Ji	Yes
2023-04-20 00:00	ActiveCampaign – Forms, Site Tracking, Live Chat <= 8.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting ActiveCampaign <= 8.1.11	`CVE-2023-0233`	6.4 Medium	István Márton	Yes
2020-09-06 00:00	ActiveCampaign < 8.0.2 - Cross-Site Request Forgery ActiveCampaign < 8.0.2	`CVE-2021-24133`	4.3 Medium	Nguyen Anh Tien	Yes

Showing 1–4 of 4 reports

Plugin Profile

Latestv8.1.21

ActiveCampaign – The autonomous marketing platform

Author

activecampaign

4.5(29)

90/100

Last Updated

2025-11-14 (10mo ago)

Active Installs

40,000+

Downloads

1,416,892

Requires WP

2.0+

Requires PHP

5.4+

Tested up to

WP 6.8.8

Created

2009-10-15 (17y ago)

ActiveCampaign is the autonomous marketing platform built to transform how marketers, agencies, and business owners work. Use Active Intelligence to power goal-aware automations and orchestrate personalized experiences across email, SMS, and WhatsApp. Effortlessly integrate with 1000+ apps, uncover deep performance insights, and optimize your workflows so you win every day. Autonomous marketing Built on the foundation of marketing automation, fuel your marketing strategy and customer journeys with AI-driven execution, optimization, and insight at every step. AI agents Run entire marketing campaigns through simple prompts, backed by Active Intelligence. Cross-channel marketing Reach prospects and customers wherever they are, with email, SMS, WhatsApp, and more. On-brand, personalized content Creative tools that deliver professional, conversion-ready designs for email and landing pages. CRM Track, manage, and automate your sales process. 1000+ apps & integrations Connect ActiveCampaign to your favorite tools. WooCommerce + ActiveCampaign Turn on ActiveCampaign site tracking in just a few clicks. Seamlessly add ActiveCampaign forms to your WordPress website. Learn more: How to use the ActiveCampaign WordPress Plugin

View on WordPress.org