Bread & Butter – Identify Website Visitors, Score Leads & Gate Content

Bread & Butter – Identify Website Visitors, Score Leads & Gate Content has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 5.7, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Cross-Site Request Forgery (CSRF).

Every one of the 3 issues recorded for Bread & Butter – Identify Website Visitors, Score Leads & Gate Content has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. Bread & Butter – Identify Website Visitors, Score Leads & Gate Content is installed on roughly 60 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.7/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Bread & Butter – Identify Website Visitors, Score Leads & Gate Content vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-4279

Bread & Butter: Content Gating for Verified Leads <= 8.6.0.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

Read the full analysis

Vulnerability Records

3 records
Bread & Butter – Identify Website Visitors, Score Leads & Gate Content banner
Latestv9.5.0.221

Bread & Butter – Identify Website Visitors, Score Leads & Gate Content

Bread & Butter

Author

Bread & Butter

4.7(7)
94/100
Last Updated
2026-09-10 (3d ago)
Active Installs
60+
Downloads
8,184
Requires WP
6.1+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2021-02-06 (6y ago)

Your analytics tells you how many people visited. Your CRM knows the ones who filled out a form. Nobody owns the middle: the visitors who were interested, looked hard, and left without a name. Bread & Butter is the middle. They told us who they are. We didn’t guess. Most visitor identification tools look up an IP address and hand you “someone at Acme.” Bread & Butter identifies people through your own forms and one-click social sign-in, so what lands in your dashboard is a real name, a role, a company, and an email address verified by the provider they signed in with. First-party data, given with consent. Nothing here breaks when third-party cookies finish dying. What changes on Monday morning Named, not guessed. Every form submission and sign-in becomes a full profile: verified email, role, seniority, company, industry, location, social profiles. No data entry, no lookups. Scored, not counted. Focused Score watches how each visitor actually behaves on your site and rates their buying intent from 1 to 10. Bots, scrapers, and your own team drop out. Your Engaged Leads tab shows the people worth calling, ranked. Briefed, not listed. Each engaged lead gets an Intelligence Brief: who they are, what they looked at, what it means, and what to do next. Sent to Slack, your CRM, or your inbox the moment they qualify. Works with the forms you already have Install the plugin and it starts listening. Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Formidable, Elementor forms, newsletter blocks: if there’s an email field on your site, Bread & Butter sees it. Your submissions still go wherever they go today. We run alongside, not in between. Capture the ones who never fill out forms Social sign-in on any form. When a visitor clicks into a form field, they can skip typing and verify with Google, Microsoft, LinkedIn, or Apple in one click. More completions, and every one of them is a confirmed identity. Content gates. Lock your best guide, report, or pricing page behind a one-click sign-in. Lock it immediately, after a scroll depth, or after a time delay. Unlock once, and the visitor is recognized across your whole site. See which traffic actually pays The Attribution Report connects each campaign, channel, and keyword to verified people and closed pipeline, not to sessions. Includes traffic from Google Ads, ChatGPT, Perplexity, and partner referrals, with bots stripped out. Your cost per lead becomes a number you can trust. Who this is for Revenue teams tired of getting a spreadsheet of email addresses and calling it lead generation. Marketers who need to prove which spend produced customers. Founders selling something considered enough that a name matters more than a click. Free to start. Lead capture and attribution run on every plan.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C