Unknown Patreon WordPress vulnerabilities

3 CVEs affecting Unknown Patreon WordPress, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-92433, published 2026-10-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-92432, published 2026-10-17. EPSS: 0.1% chance of exploitation in the next 30 days. The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external…
CVE-2026-92431, published 2026-10-17. EPSS: 0.1% chance of exploitation in the next 30 days. The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy,…
CVE-2026-92433, published 2026-10-17. EPSS: 0.1% chance of exploitation in the next 30 days. The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an…