WordPress plugin vulnerabilities
Look up the publicly known security vulnerabilities in any plugin from the wordpress.org directory: which versions are affected, how severe they are, and the version that fixes them.
How to use this
Open a plugin to see every vulnerability listed for it, grouped by the version that fixes it. Enter the version you run in the version checker on that page to see exactly which flaws affect it.
Most attacks on WordPress sites use flaws in plugins that already have a fix. Updating promptly closes them; for flaws without a fix, deactivating or replacing the plugin is the safe choice.
Common plugins
- Contact Form 7 contact-form-7
- WooCommerce woocommerce
- Elementor Website Builder elementor
- Yoast SEO wordpress-seo
- Akismet Anti-spam akismet
- Jetpack jetpack
- WPForms Lite wpforms-lite
- Classic Editor classic-editor
- Really Simple Security really-simple-ssl
- All in One SEO all-in-one-seo-pack
- LiteSpeed Cache litespeed-cache
- UpdraftPlus updraftplus
Sources and attribution
- WordPress and server vulnerability data from WPVulnerability. WPVulnerability data license.
- CVE records are copyright The MITRE Corporation. CVE Terms of Use.
- Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
- Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.
Check every plugin on your site automatically
Install the free Webforta WordPress Security plugin and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.