activecampaign vulnerabilities

Latest activecampaign CVEs

Newest publication first

1. CVE-2025-32136 WordPress ActiveCampaign Plugin <= 8.1.16 - Cross Site Scripting (XSS) vulnerability

   Published 2025-04-04

   Medium·CVSS 5.9 EPSS 0.42%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in activecampaign ActiveCampaign activecampaign-subscription-forms allows Stored XSS.This issue affects ActiveCampaign: from n/a through <= 8.1.16.

2. CVE-2024-32430 WordPress ActiveCampaign plugin <= 8.1.14 - Server Side Request Forgery (SSRF) vulnerability

   Published 2024-04-15

   Critical·CVSS 9.8 EPSS 0.35%

   Server-Side Request Forgery (SSRF) vulnerability in ActiveCampaign.This issue affects ActiveCampaign: from n/a through 8.1.14.

3. CVE-2023-0233 ActiveCampaign < 8.1.12 - Contributor+ Stored XSS

   Published 2023-05-15

   Medium·CVSS 5.4 EPSS 0.46%

   The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

4. CVE-2021-24133 ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings

   Published 2021-03-18

   Medium·CVSS 4.3 EPSS 0.47%

   Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.