Plugin security history

WP Pipes Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 9 vulnerability records associated with WP Pipes, published between 2022 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

9Total records

3Critical

2High

4Medium

0Low

0Informational

4Patched records

5Currently marked unpatched

2022-12-20First disclosure

2025-08-14Latest disclosure

9 of 9CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2022	1	1 records
2023	1	1 records
2024	1	1 records
2025	6	6 records

Severity Breakdown

Severity	Records	Share
Critical	3	33.3%
High	2	22.2%
Medium	4	44.4%

Vulnerability-Type Breakdown

SQL Injection

2 records22.2%

First: 2022. Latest: 2025.

Cross-Site Scripting

2 records22.2%

First: 2024. Latest: 2025.

Other

2 records22.2%

First: 2025. Latest: 2025.

Path Traversal

2 records22.2%

First: 2025. Latest: 2025.

CSRF

1 record11.1%

First: 2023. Latest: 2023.

Patch Status

Patched: 4
Currently marked unpatched: 5
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.4.3
1.4.2
1.4.1
1.4.0

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.4.3`	WP Pipes <= 1.4.3 - Reflected Cross-Site Scripting	August 14, 2025	Not supplied	Medium
`*-1.4.3`	WP Pipes <= 1.4.3 - Unauthenticated Local File Inclusion	July 22, 2025	Not supplied	High
`*-1.4.3`	WP Pipes <= 1.4.3 - Unauthenticated SQL Injection	July 8, 2025	Not supplied	High
`*-1.4.3`	WP Pipes <= 1.4.3 - Unauthenticated Arbitrary File Deletion	July 6, 2025	Not supplied	Critical
`*-1.4.2`	WP Pipes <= 1.4.2 - Unauthenticated Arbitrary File Deletion	May 30, 2025	1.4.3	Critical
`*-1.4.3`	WP Pipes <= 1.4.3 - Authenticated (Administrator+) Server-Side Request Forgery	May 7, 2025	Not supplied	Medium
`*-1.4.1`	WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter	December 10, 2024	1.4.2	Medium
`[*, 1.4.1)`	WP Pipes <= 1.4.0 - Cross-Site Request Forgery to Settings Update	August 11, 2023	1.4.1	Medium
`1.9`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.8`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.7`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.6`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.5`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.4`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.33`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.32`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.31`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.30`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.3`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.29`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.28`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.27`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.26`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.25`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical
`1.24`	WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection	December 20, 2022	1.4.0	Critical

Selected source records

Latest Records

MediumCVE-2025-28977

WP Pipes <= 1.4.3 - Reflected Cross-Site Scripting

Published: August 14, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

HighCVE-2025-28979

WP Pipes <= 1.4.3 - Unauthenticated Local File Inclusion

Published: July 22, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

HighCVE-2025-28982

WP Pipes <= 1.4.3 - Unauthenticated SQL Injection

Published: July 8, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2025-60227

WP Pipes <= 1.4.3 - Unauthenticated Arbitrary File Deletion

Published: July 6, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2025-48267

WP Pipes <= 1.4.2 - Unauthenticated Arbitrary File Deletion

Published: May 30, 2025

Affected versions: *-1.4.2
Patched versions: 1.4.3

Original Wordfence record

MediumCVE-2025-47664

WP Pipes <= 1.4.3 - Authenticated (Administrator+) Server-Side Request Forgery

Published: May 7, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2024-12283

WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter

Published: December 10, 2024

Affected versions: *-1.4.1
Patched versions: 1.4.2

Original Wordfence record

MediumCVE-2023-40009

WP Pipes <= 1.4.0 - Cross-Site Request Forgery to Settings Update

Published: August 11, 2023

Affected versions: [*, 1.4.1)
Patched versions: 1.4.1

Original Wordfence record

Highest-Severity Records

CriticalCVE-2022-45355

WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection

Published: December 20, 2022

Affected versions: 1.0; 1.1; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15; 1.16; 1.17; 1.18; 1.19; 1.2; 1.20; 1.21; 1.22; 1.23; 1.24; 1.25; 1.26; 1.27; 1.28; 1.29; 1.3; 1.30; 1.31; 1.32; 1.33; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9
Patched versions: 1.4.0

Original Wordfence record

CriticalCVE-2025-48267

WP Pipes <= 1.4.2 - Unauthenticated Arbitrary File Deletion

Published: May 30, 2025

Affected versions: *-1.4.2
Patched versions: 1.4.3

Original Wordfence record

CriticalCVE-2025-60227

WP Pipes <= 1.4.3 - Unauthenticated Arbitrary File Deletion

Published: July 6, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

HighCVE-2025-28979

WP Pipes <= 1.4.3 - Unauthenticated Local File Inclusion

Published: July 22, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

HighCVE-2025-28982

WP Pipes <= 1.4.3 - Unauthenticated SQL Injection

Published: July 8, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2024-12283

WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter

Published: December 10, 2024

Affected versions: *-1.4.1
Patched versions: 1.4.2

Original Wordfence record

MediumCVE-2025-28977

WP Pipes <= 1.4.3 - Reflected Cross-Site Scripting

Published: August 14, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-47664

WP Pipes <= 1.4.3 - Authenticated (Administrator+) Server-Side Request Forgery

Published: May 7, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2025-28977

WP Pipes <= 1.4.3 - Reflected Cross-Site Scripting

Published: August 14, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

HighCVE-2025-28979

WP Pipes <= 1.4.3 - Unauthenticated Local File Inclusion

Published: July 22, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

HighCVE-2025-28982

WP Pipes <= 1.4.3 - Unauthenticated SQL Injection

Published: July 8, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2025-60227

WP Pipes <= 1.4.3 - Unauthenticated Arbitrary File Deletion

Published: July 6, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-47664

WP Pipes <= 1.4.3 - Authenticated (Administrator+) Server-Side Request Forgery

Published: May 7, 2025

Affected versions: *-1.4.3
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory