WP Pipes

WP Pipes has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; 4 are fixed and 5 remain unpatched as of September 2026. Their average CVSS score is 7.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 2 high. 2025 was the busiest year with 6 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (22%). Other recurring categories include SQL Injection, Cross-Site Request Forgery (CSRF).

4 of the records (44%) have a vendor fix, while 5 remain unpatched. The oldest unresolved one dates back to 2025.

6 independent researchers contributed these findings, most of them (4) reported by LVT-tholv2k.

Strategic Overview

Avg CVSSHigh

7.3/ 10

Patch Coverage44%

Open

Fixed

Get automatic notifications for all WP Pipes vulnerabilities before they are exploited.

Most severe open issueCVSS 9.1CVE-2025-60227

WP Pipes <= 1.4.3 - Unauthenticated Arbitrary File Deletion

Read the full analysis

Vulnerability Records

9 records


2025-08-14 00:00	WP Pipes <= 1.4.3 - Reflected Cross-Site Scripting WP Pipes <= 1.4.3	`CVE-2025-28977`	6.1 Medium	LVT-tholv2k	No
2025-07-22 00:00	WP Pipes <= 1.4.3 - Unauthenticated Local File Inclusion WP Pipes <= 1.4.3	`CVE-2025-28979`	8.1 High	LVT-tholv2k	No
2025-07-08 00:00	WP Pipes <= 1.4.3 - Unauthenticated SQL Injection WP Pipes <= 1.4.3	`CVE-2025-28982`	7.5 High	LVT-tholv2k	No
2025-07-06 00:00	WP Pipes <= 1.4.3 - Unauthenticated Arbitrary File Deletion WP Pipes <= 1.4.3	`CVE-2025-60227`	9.1 Critical	LVT-tholv2k	No
2025-05-30 00:00	WP Pipes <= 1.4.2 - Unauthenticated Arbitrary File Deletion WP Pipes <= 1.4.2	`CVE-2025-48267`	9.1 Critical	timomangcut	Yes
2025-05-07 00:00	WP Pipes <= 1.4.3 - Authenticated (Administrator+) Server-Side Request Forgery WP Pipes <= 1.4.3	`CVE-2025-47664`	5.5 Medium	domiee13	No
2024-12-10 20:19	WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter WP Pipes <= 1.4.1	`CVE-2024-12283`	6.1 Medium	vgo0	Yes
2023-08-11 00:00	WP Pipes <= 1.4.0 - Cross-Site Request Forgery to Settings Update WP Pipes < 1.4.1	`CVE-2023-40009`	4.3 Medium	Nguyen Xuan Chien	Yes
2022-12-20 00:00	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection WP Pipes 1.0 – 1.33 · 34 branches	`CVE-2022-45355`	9.8 Critical	Kévin Mosbahi (Mika)	Yes

Showing 1–9 of 9 reports