WordPress plugin vulnerabilities

How our WordPress vulnerability database is built

We collect public vulnerability records rather than discovering vulnerabilities ourselves. The database combines CVE records from the CVE List, including records published by CVE Numbering Authorities such as Wordfence, Patchstack and WPScan, with enrichment from the US National Vulnerability Database and plugin information from the WordPress.org plugin directory.

New CVE records are checked every 10 minutes. NVD details are refreshed hourly, while WordPress.org plugin information such as the current version, active install count and directory status is refreshed daily. The database includes historical WordPress CVEs going back to 2010 as well as newly published records.

A published vulnerability does not mean every website using that plugin has been attacked. It means a security issue has been publicly recorded. The practical question is whether your site runs the affected software and, if so, whether your installed version falls inside the vulnerable range.

How to read a WordPress CVE entry

Start with the affected product and version range. If the entry says versions up to a particular release are affected, compare that information with the version shown in your WordPress Plugins screen. Then look for a fixed version or later safe release.

Severity is based on the CVSS score published with the CVE where one is available. CVSS is a severity measure, not a complete measure of risk. A high score deserves attention, but your real priority also depends on factors such as whether exploitation requires authentication, whether the plugin is active on your site and whether the vulnerable function is exposed.

If a plugin is shown as closed in the WordPress.org directory, that tells you it is not currently available there. It does not by itself prove that your installed copy is compromised or that no fix exists. Check the vulnerability record, the plugin vendor's information and your installed version before acting.

What to do if a plugin you use is listed

First, confirm the exact plugin and installed version. If a fixed version is available, take a current backup and update promptly. Do not assume that deactivating a plugin removes all risk if vulnerable files remain on the server, particularly where a disclosure involves code that can be reached directly.

If no fixed version exists, assess whether the plugin can be disabled and removed or replaced without breaking a critical site function. For business critical sites, test the change on staging where possible before removing a component from production.

After dealing with the vulnerable software, check for signs that the site may already have been altered. Review administrator accounts, recently changed files, unexpected pages or redirects, security logs and Google Search Console security warnings. If compromise is suspected, preserve a copy before cleaning so there is a record of what changed and investigate the entry point rather than only deleting visible files. Our website security guidance explains the wider checks. Care plans from £59 a month include weekly WordPress updates, security scanning and daily backups. Hacked Site Rescue is available at £249 if the site is already compromised.

Free alerts for new plugin vulnerabilities

You can request a free email alert for a plugin you want to watch. After you confirm the subscription by email, we will notify you when a new vulnerability record is published for that plugin. Every alert email includes an unsubscribe link.

Alerts are useful for keeping watch on important plugins, but they do not replace normal update and security routines. A vulnerability may be disclosed after a fix is already available, and not every security problem receives a CVE immediately. Keep WordPress, themes and plugins maintained, remove software you no longer use and review your site when an alert applies to something you actually run.