Very Good Plugins vulnerabilities

Products

• WP Fusion Lite 2
• Fatal Error Notify 1
• WP Fusion (Pro) 1

Latest Very Good Plugins CVEs

Newest publication first

1. CVE-2026-14444 WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter

   Published 2026-09-07

   High·CVSS 7.5 EPSS 0.36%

   The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. This makes it possibl...

2. CVE-2024-32455 WordPress Fatal Error Notify plugin <= 1.5.2 - Broken Access Control vulnerability

   Published 2024-04-16

   Medium·CVSS 4.3 EPSS 0.30%

   Missing Authorization vulnerability in Very Good Plugins Fatal Error Notify.This issue affects Fatal Error Notify: from n/a through 1.5.2.

3. CVE-2021-34660 WP Fusion Lite <= 3.37.18 Reflected Cross-Site Scripting

   Published 2021-08-09

   Medium·CVSS 6.1 EPSS 0.82%

   The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the ~/includes/admin/logging/class-log-table-list.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.37.18.

4. CVE-2021-34661 WP Fusion Lite <= 3.37.18 Cross-Site Request Forgery to Data Deletion

   Published 2021-08-09

   Medium·CVSS 4.7 EPSS 0.45%

   The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the show_logs_section function found in the ~/includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.