WebFactory
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Advanced Google reCAPTCHA | 6 | – | Oct 6, 2026 |
| WP Reset | 3 | – | Oct 7, 2025 |
| Login Lockdown & Protection | 3 | – | Dec 13, 2025 |
| Email Log | 2 | – | Sep 23, 2026 |
| Minimal Coming Soon – Coming Soon Page | 2 | – | Jun 8, 2024 |
| Order Export for WooCommerce | 2 | – | Jan 31, 2025 |
| Under Construction | 2 | – | Jun 9, 2023 |
| Maps Widget for Google Maps | 1 | – | Apr 6, 2023 |
| Under Construction Page (Pro) | 1 | – | Jul 11, 2026 |
| WordPress Charts | 1 | – | Sep 20, 2023 |
| WP Force SSL & HTTPS SSL Redirect | 1 | – | Jun 8, 2024 |
| Captcha Code | 1 | – | Sep 23, 2026 |
| AiBud WP | 1 | – | Jul 3, 2025 |
| Database Reset | 1 | – | Feb 21, 2024 |
| Login Lockdown | 1 | – | Oct 6, 2026 |
| AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o | 1 | – | May 1, 2026 |
Exploited and recent CVEs
- CVE-2026-100518 WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability 0.3%
- CVE-2026-97308 WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability 0.2%
- CVE-2026-94457 WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability 0.2%
- CVE-2026-94174 WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability 0.4%
- CVE-2026-11426 UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter 0.5%
- CVE-2026-5411 WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload 0.6%
- CVE-2026-5415 WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link 0.5%
- CVE-2024-13362 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter 0.3%
- CVE-2025-11707 Login Lockdown & Protection <= 2.14 - IP Block Bypass 0.5%
- CVE-2025-10645 WP Reset <= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log 0.3%
- CVE-2025-23968 WordPress AiBud WP plugin <= 1.9 - Arbitrary File Upload vulnerability 0.5%
- CVE-2025-3766 Login Lockdown & Protection <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting 0.3%
- CVE-2025-2074 Advanced Google reCAPTCHA <= 1.29 - Authenticated (Subscriber+) Limited SQL Injection via 'sSearch' Parameter 0.4%
- CVE-2025-1262 Advanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypass 0.3%
- CVE-2024-13623 Order Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory 0.5%
- CVE-2024-12034 Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock 0.3%
- CVE-2024-43259 WordPress Order Export for WooCommerce plugin <= 3.23 - Sensitive Data Exposure vulnerability 0.4%
- CVE-2024-5087 Minimal Coming Soon – Coming Soon Page <= 2.38 - Missing Authorization to Limited Settings Change 0.4%
- CVE-2024-4661 WP Reset <= 2.02 - Missing Authorization to License Key Modification 0.3%
- CVE-2024-5770 WP Force SSL & HTTPS SSL Redirect <= 1.66 - Missing Authorization to Settings Update 0.3%
- CVE-2024-0867 Email Log <= 2.4.8 - Unauthenticated Hook Injection 0.8%
- CVE-2023-6799 WP Reset <= 2.0 - Sensitive Information Exposure due to Insufficient Randomness 0.7%
- CVE-2024-1501 Database Reset <= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installation 0.3%
- CVE-2024-1340 Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization 0.4%
- CVE-2024-1075 Minimal Coming Soon – Coming Soon Page <= 2.37 - Unauthenticated Maintenance Mode Bypass 0.7%
- CVE-2023-5062 WordPress Charts <= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.5%
- CVE-2023-0832 Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_install_weglot 0.2%
- CVE-2023-0831 Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_ucp_dismiss_notice 0.2%
- CVE-2023-1913 Maps Widget for Google Maps <= 4.24 - Authenticated (Administrator+) Stored Cross-Site Scripting 0.4%