Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-fusion-lite
WP Fusion Lite
6 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 1, 2026WP Fusion Lite: Does not require authentication on a settings handler that runs during admin initializationCVE-2026-90974 · fixed in 3.48.0 · reported by WPScanMedium 6.5
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.
Oct 1, 2026WP Fusion Lite: Does not perform a capability check on two of its admin AJAX handlersCVE-2026-90972 · fixed in 3.48.0 · reported by WPScanMedium 5.4
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.
Apr 24, 2024WP Fusion Lite: Insertion of Sensitive Information Into Sent DataCVE-2024-32796 · affects up to 3.42.10 · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite allows Retrieve Embedded Sensitive Data.This issue affects WP Fusion Lite: from n/a through <= 3.42.10.
Apr 3, 2024WP Fusion Lite: Improper Control of Generation of Code ('Code Injection')CVE-2024-27972 · affects up to 3.41.24 · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite.This issue affects WP Fusion Lite: from n/a through <= 3.41.24.
Aug 9, 2021WP Fusion Lite: Cross-Site Request ForgeryCVE-2021-34661 · affects up to 3.37.18 · reported by WordfenceMedium 6.1
The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18.
Aug 9, 2021WP Fusion Lite: Reflected Cross-Site ScriptingCVE-2021-34660 · affects up to 3.37.18 · reported by WordfenceMedium 6.1
The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the ~/includes/admin/logging/class-log-table-list.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.37.18.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.