Wp Helper Lite Vulnerabilities

The WP Helper Premium plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 4.7.6. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 4.7.6

Fixed in:

4.7.6

Disclosed:

Aug 14, 2026

CVE-2026-18945 on NVD →

The WP Helper Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'whp_smtp_send_mail_test' function in all versions up to, and including, 4.6.1. This makes it possible for unauthenticated attackers to send emails containing any content and originatin...

CVSS:

5.3

Affected:

up to 4.6.1

Fixed in:

4.6.2

Disclosed:

Oct 9, 2024

CVE-2024-9065 on NVD →

The WP Helper Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to 4.6.0 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successful...

CVSS:

6.1

Affected:

up to 4.6.0

Fixed in:

4.6.0

Disclosed:

Apr 16, 2024

CVE-2024-32595 on NVD →

The WP Helper Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.1. This is due to missing or incorrect nonce validation on the 'whp_fields' function. This makes it possible for unauthenticated attackers to update the plugin settingsvia a forged request grante...

CVSS:

4.3

Affected:

up to 4.5.1

Fixed in:

4.5.2

Disclosed:

Oct 24, 2023

CVE-2023-46614 on NVD →

The WP Helper Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping on the GET data returned to a user via the surveySubmit_func() function. This makes it possible for unauthenticated attackers to i...

CVSS:

6.1

Affected:

up to 4.2.0

Fixed in:

4.3.0

Disclosed:

Jan 24, 2023

CVE-2023-0448 on NVD →

The WP Helper Premium plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for contributor-level attackers and above to append addition...

CVSS:

8.8

Affected:

up to 4.2.0

Fixed in:

4.3.0

Disclosed:

Jan 19, 2023