Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · computer-repair-shop
RepairBuddy
13 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 5, 2026RepairBuddy: Missing AuthorizationCVE-2026-97309 · affects up to 4.1226 · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.
Oct 5, 2026RepairBuddy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-100509 · affects up to 4.1225 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through 4.1225.
Sep 10, 2026Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.CVE-2026-81803 · affects up to 4.1224 · reported by PatchstackHigh 7.5
Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.
Aug 24, 2026Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.CVE-2026-78291 · affects up to 4.1223 · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
Jun 15, 2026Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.CVE-2026-39584 · affects up to 4.1132 · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.
May 26, 2026RepairBuddy: Missing AuthorizationCVE-2026-24638 · affects up to 4.1121 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Webful Creations RepairBuddy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RepairBuddy: from n/a through 4.1121.
Apr 8, 2026RepairBuddy: Insertion of Sensitive Information Into Sent DataCVE-2026-39586 · affects up to 4.1132 · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through <= 4.1132.
Mar 20, 2026RepairBuddy – Repair Shop CRM & Booking: Unauthorized accessCVE-2026-3567 · affects up to 4.1132 · reported by WordfenceMedium 5.3
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1132. The plugin exposes two AJAX handlers that, when combined, allow any authenticated user to modify admin-level plugin settings. First, the wc_rb_get_fresh_nonce() function (registered via wp_ajax and wp_ajax_nopriv hooks) allows any user to generate a valid WordPress nonce for any arbitrary action name by simply providing the nonce_name parameter, with no capability checks. Second, the wc_rep_shop_settings_submission() function only verifies the nonce (wcrb_main_setting_nonce) but performs no current_user_can() capability check before updating 15+ plugin options via update_option(). This makes it possible for authenticated attackers, with subscriber-level access and above, to modify all plugin configuration settings including business name, email, logo, menu label, GDPR settings, and more by first minting a valid nonce via the wc_rb_get_fresh_nonce endpoint and then calling the settings submission handler.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 16, 2026RepairBuddy – Repair Shop CRM & Booking Plugin for: Insecure Direct Object ReferenceCVE-2026-0820 · affects up to 4.1116 · reported by WordfenceMedium 4.3
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capability checks on the wc_upload_and_save_signature_handler function in all versions up to, and including, 4.1116. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary signatures to any order in the system, potentially modifying order metadata and triggering unauthorized status changes.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 4, 2025RepairBuddy: Missing AuthorizationCVE-2025-32277 · affects up to 3.8213 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through <= 3.8213.
Dec 31, 2024RepairBuddy: Missing AuthorizationCVE-2024-56061 · affects up to 3.8119 · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through <= 3.8119.
Dec 17, 2024CRM WordPress Plugin – RepairBuddy: Privilege escalationCVE-2024-12259 · affects up to 3.8120 · reported by WordfenceHigh 8.8
The CRM WordPress Plugin – RepairBuddy plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.8120. This is due to the plugin not properly validating a user's identity prior to updating their email through the wc_update_user_data AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 11, 2024RepairBuddy: Unrestricted Upload of File with Dangerous TypeCVE-2024-51793 · affects up to 3.8115 · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Upload a Web Shell to a Web Server.This issue affects RepairBuddy: from n/a through <= 3.8115.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.