Step 1: know exactly what you run
You need the plugin's slug (its folder name, as in wordpress.org/plugins/<slug>/) and the installed version. Both are on the Plugins screen in WordPress, or run wp plugin list with WP-CLI. Do this for themes too: they can be just as vulnerable.
Step 2: look the plugin up
Search the plugin in the free WordPress plugin vulnerability lookup. It lists known security issues with the affected versions, severity, CVE and CVSS score where available, and the version that fixes each issue. Other public sources include the CVE record itself, the plugin's changelog and the vulnerability databases run by WordPress security vendors.
Changelogs are a weak signal on their own: "security fix" without details is common, and some fixes are not mentioned at all. Vulnerability databases are better because they state which versions are affected.
Step 3: read the advisory properly
Not every vulnerability is an emergency. These details decide how urgent it is:
- Affected versions: is your installed version in the range? "Up to and including 2.3.1" means 2.3.2 is fixed.
- Fixed in: is there a fixed version, and is WordPress offering it to you? Premium plugins without an active license often do not show updates.
- Who can exploit it: unauthenticated (anyone on the internet) is far worse than "authenticated, administrator". Subscriber-level flaws matter if your site allows registration.
- Severity (CVSS): a rough guide; critical and high deserve same-day attention.
- Exploited in the wild: if CISA lists the flaw in its Known Exploited Vulnerabilities catalogue, treat it as urgent regardless of score. EPSS scores estimate how likely exploitation is in the next 30 days.
Step 4: act
If a fixed version exists
Update. Take a backup first and, for important sites, test the update on a staging copy. If the update is not offered, check the license (premium plugins) or download it from the vendor.
If there is no fix yet
- Deactivate and delete the plugin if you can live without it for a while.
- Replace it with a maintained alternative.
- If you must keep it, reduce exposure: disable the vulnerable feature, restrict access to the affected pages, and close user registration if the flaw needs a logged-in user.
- Some WAF vendors publish virtual patches for specific plugin flaws. Note that Webforta Shield does not offer per-vulnerability virtual patches.
If the plugin is closed or abandoned
Plugins closed on wordpress.org stop receiving updates through WordPress, sometimes because of an unfixed security issue. A plugin with no release in a long time may never fix the next flaw found in it. Plan a replacement either way.
Common types of plugin vulnerability
Advisories use standard names. Knowing what they mean helps you judge the risk to your own site:
- Cross-site scripting (XSS): the plugin outputs input without escaping it, so an attacker can run JavaScript in visitors' or administrators' browsers. Stored XSS that reaches an administrator can lead to a full takeover.
- SQL injection: input reaches a database query unsafely, which can expose or change data, including user accounts.
- Broken access control: a function forgets to check the user's role or a nonce, letting subscribers (or anyone) change settings or read data.
- Cross-site request forgery (CSRF): an administrator who visits a malicious page can be made to perform an action without knowing.
- Arbitrary file upload: an attacker can upload a PHP file and run it. These are usually critical.
- Privilege escalation: a low-level user can make themselves an administrator.
Step 5: keep watching
Vulnerabilities are published every day, so a clean lookup today says nothing about next week. Webforta checks the plugin, theme and core versions it can see from the outside (from public files such as readme.txt and asset versions) against the free WPVulnerability database on every scan, and re-matches every verified site's software daily so a newly published flaw triggers an alert.
Versions read from outside can differ from what is actually installed. With the free Webforta WordPress Security plugin connected, Webforta uses the real plugin inventory instead, and shows "safe to update" advice for every pending update: whether it fixes known vulnerabilities, fixes one exploited in the wild, or leaves some unfixed. That advice uses public vulnerability data only, so an update with no known fixes is not guaranteed risk-free.