WP-Recall – Registration, Profile, Commerce & More

WP-Recall – Registration, Profile, Commerce & More has 17 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2025; 13 are fixed and 4 remain unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 10.0 out of 10. Severity breakdown: 3 critical and 2 high. 2025 was the busiest year with 10 disclosures.

The most common weakness is SQL Injection, behind 5 of the records (29%). Other recurring categories include Cross-Site Scripting, Missing Authorization.

13 of the records (76%) have a vendor fix, while 4 remain unpatched. The oldest unresolved one dates back to 2025.

12 independent researchers contributed these findings, most of them (4) reported by Krzysztof Zając.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage76%

Open

Fixed

Get automatic notifications for all WP-Recall – Registration, Profile, Commerce & More vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2025-47653

WP-Recall <= 16.26.14 - Authenticated (Contributor+) Local File Inclusion

Read the full analysis

Vulnerability Records

17 records


2025-06-26 00:00	WP-Recall <= 16.26.14 - Reflected Cross-Site Scripting WP-Recall <= 16.26.14	`CVE-2025-52796`	6.1 Medium	Nguyen Xuan Chien	No
2025-06-19 00:00	WP-Recall <= 16.26.14 - Missing Authorization WP-Recall <= 16.26.14	`CVE-2025-49991`	5.3 Medium	Nguyen Xuan Chien	No
2025-06-05 00:00	WP-Recall <= 16.26.14 - Cross-Site Request Forgery WP-Recall <= 16.26.14	`CVE-2025-30981`	4.3 Medium	0xd4rk5id3	No
2025-05-07 00:00	WP-Recall <= 16.26.14 - Authenticated (Contributor+) Local File Inclusion WP-Recall <= 16.26.14	`CVE-2025-47653`	8.8 High	Muhammad Yudha - DJ	No
2025-04-07 00:00	WP-Recall <= 16.26.11 - Authenticated (Admin+) Stored Cross-Site Scripting WP-Recall <= 16.26.11	`CVE-2024-9771`	4.4 Medium	Bob Matyas	Yes
2025-03-07 20:57	WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection WP-Recall <= 16.26.10	`CVE-2025-1323`	7.5 High	Krzysztof Zając	Yes
2025-03-07 20:52	WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Exeuction WP-Recall <= 16.26.10	`CVE-2025-1325`	6.3 Medium	Krzysztof Zając	Yes
2025-03-07 00:00	WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode WP-Recall <= 16.26.10	`CVE-2025-1324`	6.4 Medium	Krzysztof Zając	Yes
2025-03-07 00:00	WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure WP-Recall <= 16.26.10	`CVE-2025-1322`	4.3 Medium	Krzysztof Zając	Yes
2025-03-03 00:00	WP-Recall – Registration, Profile, Commerce & More <= 16.26.11 - Authenticated (Admin+) SQL Injection WP-Recall <= 16.26.11	`CVE-2024-9770`	4.9 Medium	y4ng0615	Yes

Showing 1–10 of 17 reports