WP Private Content Plus

WP Private Content Plus has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2025; 5 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (29%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Authorization Bypass Through User-Controlled Key.

5 of the records (71%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2025.

4 independent researchers contributed these findings, most of them (2) reported by Francesco Carlucci.

Strategic Overview

Avg CVSSMedium

5.3/ 10

Patch Coverage71%

Open

Fixed

Get automatic notifications for all WP Private Content Plus vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2025-10720

WP Private Content Plus <= 3.6.2 - Unauthenticated Information Exposure

Read the full analysis

Vulnerability Records

7 records


2025-09-19 00:00	WP Private Content Plus <= 3.6.2 - Unauthenticated Information Exposure WP Private Content Plus <= 3.6.2	`CVE-2025-10720`	5.3 Medium	Lorenzo Camilli	No
2025-08-11 13:49	WP Private Content Plus <= 3.6.2 - Unauthenticated Sensitive Information Exposure WP Private Content Plus <= 3.6.2	`CVE-2025-4390`	5.3 Medium	Luca Epifanio (Bitcube Security)	No
2024-12-05 19:31	WP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure WP Private Content Plus <= 3.6.1	`CVE-2024-11292`	5.3 Medium	Francesco Carlucci	Yes
2024-02-27 00:00	WP Private Content Plus <= 3.6 - Protection Mechanism Bypass WP Private Content Plus <= 3.6	`CVE-2024-0680`	5.3 Medium	Francesco Carlucci	Yes
2023-01-14 00:00	WP Private Content Plus <= 3.4 - Authenticated(Admin+) Stored Cross-Site Scripting WP Private Content Plus <= 3.4	`N/A`	4.4 Medium	Anonymous	Yes
2021-03-01 00:00	WP Private Content Plus <= 3.1 - Cross-Site Request Forgery Bypass WP Private Content Plus <= 3.1	`CVE-2021-4385`	4.3 Medium	Jerome Bruandet	Yes
2019-08-27 00:00	WP Private Content Plus <= 1.31 - Unauthenticated Settings Change WP Private Content Plus <= 1.31	`CVE-2019-15816`	7.5 High	Jerome Bruandet	Yes

Showing 1–7 of 7 reports