ConvertPlus

ConvertPlus has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2025; all 6 are fixed as of September 2026. Their average CVSS score is 7.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 4 high. 2024 was the busiest year with 3 disclosures.

The most common weakness is Deserialization Of Untrusted Data, behind 2 of the records (33%). Other recurring categories include Missing Authorization, Improper Authorization.

Every one of the 6 issues recorded for ConvertPlus has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSHigh

7.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all ConvertPlus vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8

ConvertPlug <= 3.4.2 - Unauthenticated Administrator Creation

Read the full analysis

Vulnerability Records

6 records


2025-02-11 00:00	Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update ConvertPlus <= 3.5.30	`CVE-2024-13800`	8.1 High	Lucio Sá	Yes
2024-05-15 00:00	ConvertPlus <= 3.5.26 - Authenticated (Contributor+) PHP Object Injection ConvertPlus <= 3.5.26	`CVE-2024-4838`	7.5 High	haidv35	Yes
2024-05-03 00:00	ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update ConvertPlus <= 3.5.25	`CVE-2024-3237`	5.4 Medium	M.Awad	Yes
2024-05-03 00:00	ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection ConvertPlus <= 3.5.25	`CVE-2024-3240`	8.8 High	1337_Wannabe	Yes
2019-06-07 00:00	ConvertPlus <= 3.4.4 - Unauthorized Account Creation ConvertPlus <= 3.4.4	`CVE-2019-15863`	7.5 High	Anonymous	Yes
2019-05-29 00:00	ConvertPlug <= 3.4.2 - Unauthenticated Administrator Creation ConvertPlus < 3.4.3	`N/A`	9.8 Critical	Mikey Veenstra	Yes

Showing 1–6 of 6 reports