Skip to content
OpenAdvisories

Vendor

nofearinc

4 known vulnerabilities.

Products

WP-CRM System – Manage Clients and Projects 2 DX Unanswered Comments 1 DX Share Selection 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-9004

    WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter

    The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contribut…

    nofearinc WP-CRM System – Manage Clients and Projects Web / CMS
  • Medium 4.3
    CVE-2026-4138

    DX Unanswered Comments <= 1.7 - Cross-Site Request Forgery via Settings Update

    The DX Unanswered Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce validation on the plugin's settings form in the dxuc-unanswered-comments-admin-page.php file. T…

    nofearinc DX Unanswered Comments Web / CMS
  • Medium 5.4
    CVE-2025-14854

    WP-CRM System – Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification

    The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipients and wpcrm_system_ajax_task_change_status AJAX functions in all versions up to, and including, 3.4.5. This makes it p…

    nofearinc WP-CRM System – Manage Clients and Projects Web / CMS