sequel
sequel has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for sequel has a vendor fix available, so running the current release closes it.
All of these findings were reported by luc. sequel is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-31389Sequel <= 1.0.11 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
Sequel is a powerful WordPress plugin that transforms your website into a comprehensive virtual or hybrid live engagement platform. Built on the robust Sequel.io infrastructure, this plugin enables you to seamlessly embed interactive networking hubs and live events directly into your WordPress content. Key Features Networking Hubs: Create interactive virtual networking spaces where attendees can connect, chat, and engage with each other Live Events: Host virtual or hybrid events with full video conferencing capabilities User Integration: Automatically passes WordPress user information (name, email, avatar) to provide personalized experiences UTM Tracking: Full support for UTM parameters and marketing campaign tracking Join Codes: Support for easy event access via join codes Responsive Design: Embedded content adapts to any screen size Camera & Microphone Access: Full support for interactive video and audio features Screen Sharing: Built-in support for display capture and screen sharing Shortcodes The plugin provides five shortcodes for embedding different types of content: [sequel_networking_hub]content_id[/sequel_networking_hub] – Embed a networking hub [introvoke_mingle]content_id[/introvoke_mingle] – Legacy shortcode for networking hubs [sequel_event]event_id[/sequel_event] – Embed a live event [introvoke_event]event_id[/introvoke_event] – Alternative shortcode for events [IntrovokeEvent]event_id[/IntrovokeEvent] – Legacy event shortcode User Experience The plugin automatically captures and passes through: – All URL parameters for tracking and analytics – UTM tracking parameters (utm_source, utm_medium, utm_campaign, etc.) – Custom query parameters – Join codes for event access – Facebook, Google, and Microsoft click IDs (fbclid, gclid, msclkid) Usage Basic Event Embedding To embed a live event: [sequel_event]your-event-id[/sequel_event] Basic Networking Hub Embedding To embed a networking hub: [sequel_networking_hub]your-hub-id[/sequel_networking_hub] With Join Codes Users can access events directly using join codes in the URL: https://yoursite.com/event-page/?joinCode=ABC123 With UTM Tracking All UTM parameters are automatically passed through: https://yoursite.com/event-page/?utm_source=email&utm_campaign=launch&utm_medium=newsletter Support For support and questions, please visit Sequel.io or contact our support team. External Services This plugin connects to external services to provide its functionality: Sequel.io Embedding Service This plugin embeds interactive content from Sequel.io to display networking hubs and live events. When users access embedded content, the following data is sent to Sequel.io: – All URL parameters including UTM tracking parameters – Custom query parameters – Join codes (when provided) This data is sent every time embedded content is loaded and is necessary to track user engagement and provide proper analytics. Service provider: Sequel.io – Terms of Service: https://www.sequel.io/terms – Privacy Policy: https://www.sequel.io/privacy Privacy Policy This plugin passes URL parameters to Sequel.io for tracking and analytics purposes. Please review Sequel.io’s privacy policy for information about how this data is handled.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C