Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · patreon-connect
Patreon
12 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 17, 2026Patreon: Does not verify a nonceCVE-2026-92433 · fixed in 1.10.0 · reported by WPScanMedium 6.5
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.
Oct 17, 2026Patreon: Does not validate a user-supplied redirect destination before redirectingCVE-2026-92432 · fixed in 1.10.0 · reported by WPScanMedium 4.3
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.
Oct 17, 2026Patreon: Does not perform an authorization check on some of its functionalityCVE-2026-92431 · fixed in 1.10.0 · reported by WPScanLow 3.7
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.
Oct 12, 2026Patreon: Cross-Site Request Forgery (CSRF)CVE-2026-108481 · affects up to 1.10.0 · reported by PatchstackHigh 7.4
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.
Oct 12, 2026Patreon: Cross-Site Request Forgery (CSRF)CVE-2026-108479 · affects up to 1.9.17 · reported by PatchstackHigh 8.1
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.
Jan 24, 2025Patreon: Missing AuthorizationCVE-2025-24588 · affects up to 1.9.1 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in patreon Patreon WordPress patreon-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Patreon WordPress: from n/a through <= 1.9.1.
Jul 9, 2024Patreon: Authentication Bypass by SpoofingCVE-2024-37430 · affects up to 1.9.0 · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in patreon Patreon WordPress patreon-connect.This issue affects Patreon WordPress: from n/a through <= 1.9.0.
Nov 18, 2023Patreon: Cross-Site Request Forgery (CSRF)CVE-2023-41129 · affects up to 1.8.6 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from n/a through 1.8.6.
Mar 14, 2022Patreon: Does not sanitise and escape the field "Custom Patreon Page name"CVE-2021-25026 · fixed in 1.8.2 · reported by WPScanMedium 5.5
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Apr 12, 2021The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged adCVE-2021-24231 · fixed in 1.7.0 · reported by WPScanMedium 6.5
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link.
Apr 12, 2021The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged inCVE-2021-24230 · fixed in 1.7.0 · reported by WPScanHigh 8.1
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the victim’s account once visited. If exploited, this bug can be used to overwrite the “wp_capabilities” meta, which contains the affected user account’s roles and privileges. Doing this would essentially lock them out of the site, blocking them from accessing paid content.
Aug 22, 2019The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.CVE-2018-20984 · fixed in 1.2.2 · reported by MITRECritical 9.8
The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.