HelloAsso

HelloAsso has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 5 are fixed as of September 2026. Their average CVSS score is 5.6, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Missing Authorization.

Every one of the 5 issues recorded for HelloAsso has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each. HelloAsso is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

5.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all HelloAsso vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-24575

HelloAsso <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

5 records


2025-01-24 00:00	HelloAsso <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting HelloAsso <= 1.1.11	`CVE-2025-24575`	6.4 Medium	Kévin Mosbahi (Mika)	Yes
2024-09-04 00:00	HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update HelloAsso <= 1.1.10	`CVE-2024-7605`	4.3 Medium	Peter Thaleikis	Yes
2024-08-29 00:00	HelloAsso <= 1.1.10 - Missing Authorization HelloAsso <= 1.1.10	`CVE-2024-44052`	4.3 Medium	Trương Hữu Phúc (truonghuuphuc)	Yes
2024-07-04 00:00	HelloAsso <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting HelloAsso <= 1.1.9	`CVE-2024-37488`	6.4 Medium	akas wisnu aji	Yes
2024-04-19 00:00	HelloAsso <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting HelloAsso <= 1.1.5	`CVE-2024-32697`	6.4 Medium	Khalid	Yes

Showing 1–5 of 5 reports

Latestv1.1.24

HelloAsso

Author

HelloAsso

3.6(5)

72/100

Last Updated

2025-12-09 (9mo ago)

Active Installs

4,000+

Downloads

63,634

Requires WP

4.0+

Requires PHP

7.2.34+

Tested up to

WP 6.9.7

Created

2019-10-25 (7y ago)

HelloAsso est la solution gratuite (0 frais, 0 commission) des associations pour collecter des dons et des paiements sur internet. Plus de 80 000 associations françaises font confiance à HelloAsso pour gagner du temps et recevoir des paiements en ligne afin de financer leurs projets. Quel que soit le besoin de votre association, HelloAsso vous permet de proposer le paiement en ligne : don en ligne, billetterie, adhésion / cotisation, crowdfunding, et davantage ! L’extension HelloAsso vous permet d’intégrer tous vos formulaires de paiement HelloAsso directement sur votre site WordPress. Cas d’usage : Financez de nouveaux projets (https://www.helloasso.com/activites/financement-de-projet) Organisez des événements (https://www.helloasso.com/activites/spectacle-concert) Gérez des compétitions et tournois (https://www.helloasso.com/activites/competition-tournoi) Proposez des ateliers et des stages (https://www.helloasso.com/activites/atelier-stage) Gérez vos adhérents et leur cotisation (https://www.helloasso.com/outils/gerer-mes-adhesions) Fonctionnalités : L’extension HelloAsso permet vous permet d’intégrer vos formulaires de paiement HelloAsso directement sur le site WordPress de votre association. Vous bénéficiez donc de toutes les fonctionnalités de HelloAsso : * Gestion des adhésions et adhérents * Billetterie et organisation d’événément * Collecte de dons * Campagne de financement participatif * Formulaire de vente Support HelloAsso : Une équipe de 15 personnes disponible via notre centre d’aide. Video

View on WordPress.org