Action Network
Action Network has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 3 are fixed as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include SQL Injection.
Every one of the 3 issues recorded for Action Network has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Action Network is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2024-2954WordPress Action Network 1.4.3 -Authentcated (Admin+) SQL Injection
Read the full analysisVulnerability Records

Action Network
Author
Concerted Action
A free WordPress plugin for the Action Network online organizing tools maintained by Concerted Action. Features: Create a WordPress shortcode or widget from any Action Network embed code. Manage your saved embed codes using the WordPress backend. Supports sorting by title, type and last modified date, and provides a search function. Modify Action Network’s default “thank you for your support” and “help us by using sharing tools” messages, and control which sharing options (social, email & embed codes) are displayed, using shortcode options or widget controls. Use [actionnetwork_list] shortcode or Action Network List widget to show a list of current actions. Use [actionnetwork_calendar] shortcode or Action Network Calendar widget to show a list of upcoming events. Optionally outputs upcoming events in JSON. Development of this feature was supported by The People’s Lobby – if you like it, please consider making a donation to them. If you are an Action Network Partner, use your API key to sync all of your actions from Action Network to WordPress. Create signup widgets which allow visitors to your site to sign up for your email list without using Action Network javascript embeds. This allows you to place a signup form on every page (for example in the sidebar), and still load Action Network embed codes for actions on particular pages (since Action Network’s scripts will only load one embed code per page). This feature does require the API key, so you have to be an Action Network Partner to use it. Detailed specs for shortcode attributes, widget options, etc. are available on the Help menu for the Action Network page on the backend.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C