CWW Companion

CWW Companion has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

Every one of the 2 issues recorded for CWW Companion has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. CWW Companion is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

5.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all CWW Companion vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2024-2130

CWW Companion <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records


2025-12-15 00:00	CWW Companion <= 1.3.2 - Cross-Site Request Forgery CWW Companion <= 1.3.2	`CVE-2025-67473`	4.3 Medium	Trương Hữu Phúc (truonghuuphuc)	Yes
2024-03-12 00:00	CWW Companion <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting CWW Companion <= 1.2.7	`CVE-2024-2130`	6.4 Medium	Francesco Carlucci	Yes

Showing 1–2 of 2 reports

Plugin Profile

Latestv1.3.9

CWW Companion

Author

codeworkweb

0.0(0)

0/100

Last Updated

2026-04-13 (5mo ago)

Active Installs

1,000+

Downloads

67,393

Requires WP

3.0.1+

Requires PHP

7.4+

Tested up to

WP 6.9.7

Created

2021-05-29 (5y ago)

This plugin adds some useful featuers to themes made by us(Code Work Web). Feedback If you like this plugin, then please leave us a good rating and review.

View on WordPress.org