LeadConnector

LeadConnector has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 3 disclosures.

The most common weakness is Missing Authorization, behind 3 of the records (60%). Other recurring categories include Cross-Site Scripting.

Every one of the 5 issues recorded for LeadConnector has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each. LeadConnector is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all LeadConnector vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2026-81298

LeadConnector <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

5 records


2026-08-28 00:00	LeadConnector <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting LeadConnector <= 4.0.5	`CVE-2026-81298`	7.2 High	daroo	Yes
2026-03-30 00:00	LeadConnector < 3.0.22 - Missing Authorization LeadConnector < 3.0.22	`CVE-2026-1890`	5.3 Medium	ibrahimsql	Yes
2026-01-23 00:00	LeadConnector <= 3.0.21 - Missing Authorization LeadConnector <= 3.0.21	`CVE-2026-25441`	5.3 Medium	YOUSEF MISHAAL ALI	Yes
2025-03-27 00:00	LeadConnector <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting LeadConnector <= 3.0.2	`CVE-2025-30893`	6.4 Medium	Peter Thaleikis	Yes
2024-04-29 00:00	LeadConnector <= 1.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion LeadConnector <= 1.7	`CVE-2024-1371`	6.5 Medium	Krzysztof Zając	Yes

Showing 1–5 of 5 reports

Latestv4.0.6

LeadConnector

Author

LeadConnector

2.3(11)

46/100

Last Updated

2026-08-24 (20d ago)

Active Installs

20,000+

Downloads

865,487

Requires WP

6.2+

Requires PHP

7.4+

Tested up to

WP 7.1

Created

2020-12-08 (6y ago)

Turn your WordPress site into a LeadConnector-powered conversion engine. LeadConnector connects WordPress with your LeadConnector CRM so your site can capture leads, book appointments, publish funnels, display reviews, and personalize content from one connected admin experience. Key Features Lead capture tools: Add chat widgets, forms, surveys, quizzes, calendars, phone pools, and reviews widgets. Funnel publishing: Import LeadConnector funnel steps as WordPress pages using iframe, redirect, or native HTML display. CRM personalization: Sync LeadConnector custom values into WordPress content. Email and SEO: Send WordPress email through LeadConnector SMTP and manage page metadata. AI and cache tools: Use supported AI Pages workflows and purge Rocket.net cache when configured.

View on WordPress.org