WebFactory vulnerabilities
We track 6 vulnerabilities in WebFactory products across 5 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on June 5, 2026.
Latest WebFactory vulnerabilities
- 8.8 High severity
Advanced Google reCAPTCHA: Authentication Bypass Using an Alternate Path or Channel
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler re
- 8.8 High severity
Advanced Google reCAPTCHA: Unrestricted Upload of File with Dangerous Type
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax
- 9.1 Critical severity
AiBud WP: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in WebFactory AiBud WP aibuddy-openai-chatgpt allows Upload a Web Shell to a Web Server.This issue affects AiBud WP: from n/a through <= 1.9.
- 7.5 High severity
Order Export for WooCommerce: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in WebFactory Order Export for WooCommerce order-export-and-more-for-woocommerce.This issue affects Order Export for WooCommerce: from n/a through <= 3.23.
- 8.1 High severity
Email Log: Improper Control of Generation of Code
The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under c
- 7.2 High severity
Login Lockdown – Protect Login Form: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WebFactory Ltd Login Lockdown – Protect Login Form.This issue affects Login Lockdown – Protect Login Form: from n/a through 2.06.