WEN Solutions vulnerabilities

Products

• Notice Bar 2
• Contact Form 7 GetResponse Extension 1
• WP Child Theme Generator 1
• WP Travel 1

Latest WEN Solutions CVEs

Newest publication first

1. CVE-2026-81796 WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability

   Published 2026-09-10

   High·CVSS 7.3 EPSS 0.40%

   Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3.

2. CVE-2026-24557 WordPress Contact Form 7 GetResponse Extension plugin <= 1.0.8 - Sensitive Data Exposure vulnerability

   Published 2026-01-23

   Medium·CVSS 5.3 EPSS 0.29%

   Insertion of Sensitive Information Into Sent Data vulnerability in WEN Solutions Contact Form 7 GetResponse Extension contact-form-7-getresponse-extension allows Retrieve Embedded Sensitive Data.This issue affects Contact Form 7 GetResponse Extension: from n/a through <= 1.0.8.

3. CVE-2025-49389 WordPress Notice Bar Plugin <= 3.1.3 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-08-20

   Medium·CVSS 6.5 EPSS 0.22%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Solutions Notice Bar notice-bar allows Stored XSS.This issue affects Notice Bar: from n/a through <= 3.1.3.

4. CVE-2023-47873 WordPress WP Child Theme Generator plugin <= 1.0.9 - Arbitrary File Upload vulnerability

   Published 2024-03-26

   High·CVSS 7.2 EPSS 2.3%

   Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator: from n/a through 1.0.9.

5. CVE-2023-41847 WordPress Notice Bar Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-10-02

   Medium·CVSS 5.4 EPSS 0.35%

   Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WEN Solutions Notice Bar plugin <= 3.1.0 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.