Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-crm-system
WP-CRM
9 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 22, 2026WP-CRM System – Manage Clients and Projects: Sensitive Information ExposureCVE-2026-9004 · affects up to 3.4.6 · reported by WordfenceMedium 4.3
The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address information of arbitrary CRM contact records by enumerating the contact_id parameter.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026WP-CRM System: Missing AuthorizationCVE-2025-62106 · affects up to 3.4.5 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.5.
Jan 14, 2026WP-CRM System: Unauthorized accessCVE-2025-14854 · affects up to 3.4.5 · reported by WordfenceMedium 5.4
The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipients and wpcrm_system_ajax_task_change_status AJAX functions in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers, with subscriber level access and above, to enumerate CRM contact email addresses (PII disclosure) and modify CRM task statuses. CVE-2025-62106 is likely a duplicate of this issue.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2025WP-CRM System: Missing AuthorizationCVE-2025-62740 · affects up to 3.4.6 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.6.
Jun 6, 2025WP-CRM System: Missing AuthorizationCVE-2025-49270 · affects up to 3.4.2 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP-CRM System: from n/a through <= 3.4.2.
May 7, 2025WP-CRM System: Deserialization of Untrusted DataCVE-2025-47629 · affects up to 3.4.5 · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Object Injection.This issue affects WP-CRM System: from n/a through <= 3.4.5.
Dec 31, 2024WP-CRM System: Missing AuthorizationCVE-2024-55991 · affects up to 3.2.9.1 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.2.9.1.
Mar 29, 2024WP-CRM System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30434 · affects up to 3.2.9 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-CRM System allows Stored XSS.This issue affects WP-CRM System: from n/a through 3.2.9.
Jun 13, 2022WP-CRM: Does not validate and sanitise fieldsCVE-2022-1202 · affects up to 1.2.1 · reported by WPScanHigh 7.8
The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.