Passwords Manager

Passwords Manager has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; all 4 are fixed as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 2 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is SQL Injection, behind 3 of the records (75%). Other recurring categories include Cross-Site Scripting.

Every one of the 4 issues recorded for Passwords Manager has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Lucio Sá. Passwords Manager is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Passwords Manager vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2024-12613

Passwords Manager <= 1.4.8 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

4 records


2025-01-15 21:19	Passwords Manager <= 1.4.8 - Unauthenticated SQL Injection Passwords Manager <= 1.4.8	`CVE-2024-12613`	7.5 High	Lucio Sá	Yes
2025-01-15 00:00	Passwords Manager <= 1.4.8 - Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key Passwords Manager <= 1.4.8	`CVE-2024-12614`	7.5 High	Lucio Sá	Yes
2025-01-15 00:00	Passwords Manager <= 1.4.8 - Authenticated (Subscriber+) SQL Injection Passwords Manager <= 1.4.8	`CVE-2024-12615`	6.5 Medium	Lucio Sá	Yes
2022-05-21 00:00	Passwords Manager <= 1.4.4 - Cross-Site Scripting via pwdms_csv_category parameter Passwords Manager <= 1.4.4	`N/A`	5.5 Medium	Anonymous	Yes

Showing 1–4 of 4 reports

Latestv1.5.3

Passwords Manager

Author

5.0(5)

100/100

Last Updated

2026-09-05 (8d ago)

Active Installs

100+

Downloads

7,746

Requires WP

6.3.2+

Requires PHP

Tested up to

WP 7.1

Created

2019-10-24 (7y ago)

Passwords Manager wordpress plugin let you to store different passwords at one place. Passwords are stored in WordPress database in encrypted form so no one can see them. Passwords can also be categorized if you have multiple passwords. This plugin uses advanced encryption standard AES – 128 and you can define your encryption key at the time of installation of plugin. Watch this video to see how the plugin works: New Features of Passwords Manager 1.5.2 includes: Category Color field for each category name. Clone the existing Password Record in the Passwords section. Improved Mobile Responsive User Interface. New Feature to add Sample Data in Import Section. Translations added for following languages: Spanish Hindi Japanese Portuguese Russian Chinese Key features of this plugin include Ability to store all passwords at once place. Bootstrap based UI for managing all passwords. All passwords are encrypted. Passwords can be differentiated based on different categories. Datatables to list all passwords and categories. Export / Import all passwords. Use shortcode to share passwords table on any wordpress page. Added URL field in passwords form

View on WordPress.org