ConvertPlus

ConvertPlus has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; all 7 are fixed as of October 2026. Their average CVSS score is 8.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 5 high. 2024 was the busiest year with 3 disclosures.

The most common weakness is Deserialization Of Untrusted Data, behind 2 of the records (29%). Other recurring categories include Missing Authorization, Improper Authorization.

Every one of the 7 issues recorded for ConvertPlus has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSHigh

8.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all ConvertPlus vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8

ConvertPlug <= 3.4.2 - Unauthenticated Administrator Creation

Read the full analysis

Vulnerability Records

7 records


2026-09-28 07:22	ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter ConvertPlus <= 3.6.3	`CVE-2026-87741`	8.8 High	Rafie Muhammad	Yes
2025-02-11 00:00	Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update ConvertPlus <= 3.5.30	`CVE-2024-13800`	8.1 High	Lucio Sá	Yes
2024-05-15 00:00	ConvertPlus <= 3.5.26 - Authenticated (Contributor+) PHP Object Injection ConvertPlus <= 3.5.26	`CVE-2024-4838`	7.5 High	haidv35	Yes
2024-05-03 00:00	ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update ConvertPlus <= 3.5.25	`CVE-2024-3237`	5.4 Medium	M.Awad	Yes
2024-05-03 00:00	ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection ConvertPlus <= 3.5.25	`CVE-2024-3240`	8.8 High	1337_Wannabe	Yes
2019-06-07 00:00	ConvertPlus <= 3.4.4 - Unauthorized Account Creation ConvertPlus <= 3.4.4	`CVE-2019-15863`	7.5 High	Anonymous	Yes
2019-05-29 00:00	ConvertPlug <= 3.4.2 - Unauthenticated Administrator Creation ConvertPlus < 3.4.3	`N/A`	9.8 Critical	Mikey Veenstra	Yes

Showing 1–7 of 7 reports