Is my WordPress plugin safe?
Type a plugin name. You get its latest version, when it was last updated, how many sites run it, and every known vulnerability by version, with the source for each one.
201 plugins catalogued · 2,077 vulnerability records · vulnerability data refreshed 2026-11-01. Not listed? Search anyway: we look it up on wordpress.org and add it.
Latest version has a known unpatched issue
The sources we check list the newest release as affected and name no fix yet.
| Plugin | Latest | Active installs | Unpatched |
|---|---|---|---|
| Redux Framework | 4.5.16 | 900,000+ | 1 |
Recently disclosed vulnerabilities
| Published | Plugin | Issue | Severity |
|---|---|---|---|
| 2026-10-31 | Photo Gallery, Sliders, Proofing and Themes | Remote code execution CVE-2026-76010 | high |
| 2026-10-31 | Ninja Forms | DOM-based cross-site scripting (XSS) CVE-2026-100151 | medium |
| 2026-10-31 | WP Activity Log | Stored cross-site scripting (XSS) CVE-2026-120075 | high |
| 2026-10-31 | All in One SEO | Information disclosure CVE-2026-109367 | medium |
| 2026-10-31 | SEOPress | Stored cross-site scripting (XSS) CVE-2026-116535 | medium |
| 2026-10-31 | Redux Framework | Missing authorization check CVE-2026-103997 | medium |
| 2026-10-31 | W3 Total Cache | Stored cross-site scripting (XSS) CVE-2026-120019 | medium |
| 2026-10-31 | W3 Total Cache | Stored cross-site scripting (XSS) CVE-2026-111254 | high |
| 2026-10-31 | PDF Invoices & Packing Slips for WooCommerce | Information disclosure CVE-2026-109217 | medium |
| 2026-10-31 | PDF Invoices & Packing Slips for WooCommerce | Stored cross-site scripting (XSS) CVE-2026-107750 | high |
| 2026-10-31 | Spectra Legacy | Missing authorization check CVE-2026-92294 | medium |
| 2026-10-31 | Security Optimizer | Security issue CVE-2026-118185 | unscored |
| 2026-10-31 | Essential Addons for Elementor | Security issue CVE-2026-110808 | unscored |
| 2026-10-31 | Photo Gallery, Sliders, Proofing and Themes | DOM-based cross-site scripting (XSS) CVE-2026-116563 | medium |
| 2026-10-31 | Ninja Forms | Stored cross-site scripting (XSS) CVE-2026-109997 | high |
Most-installed plugins
| Plugin | Latest | Active installs | Known issues | Unpatched in latest |
|---|---|---|---|---|
| Elementor Website Builder | 4.3.5 | 10+ million | 51 | none known |
| Yoast SEO | 28.8 | 10+ million | 14 | none known |
| Contact Form 7 | 6.2.4.1 | 10+ million | 7 | none known |
| Classic Editor | 1.7.0 | 8+ million | 0 | none known |
| LiteSpeed Cache | 7.9.2 | 7+ million | 29 | none known |
| WooCommerce | 11.2.1 | 7+ million | 24 | none known |
| Site Kit by Google | 1.190.0 | 5+ million | 3 | none known |
| Akismet Anti-spam | 5.7.2 | 5+ million | 1 | none known |
| WPForms | 2.0.3.1 | 5+ million | 17 | none known |
| All-in-One WP Migration and Backup | 7.113 | 5+ million | 10 | none known |
| Wordfence Security | 9.0.2 | 5+ million | 2 | none known |
| WP Mail SMTP by WPForms | 4.10.3 | 4+ million | 1 | none known |
| Rank Math SEO | 1.0.280 | 4+ million | 33 | none known |
| UpdraftPlus | 1.26.14 | 4+ million | 10 | none known |
| Yoast Duplicate Post | 4.7 | 3+ million | 3 | none known |
| Duplicate Page | 4.5.9 | 3+ million | 1 | none known |
| Jetpack | 16.3.1 | 3+ million | 12 | none known |
| Really Simple Security | 9.8.4 | 3+ million | 13 | none known |
| WPCode | 2.4.1 | 3+ million | 1 | none known |
| Hostinger Tools | 3.0.80 | 3+ million | 1 | none known |
| Redirection | 5.10.1 | 2+ million | 4 | none known |
| All in One SEO | 5.0.4 | 2+ million | 21 | none known |
| WordPress Importer | 0.9.7 | 2+ million | 1 | none known |
| MonsterInsights | 11.3.0 | 2+ million | 4 | none known |
| Classic Widgets | 0.3 | 2+ million | 0 | none known |
| Ultimate Addons for Elementor | 2.9.6 | 2+ million | 13 | none known |
| WPS Hide Login | 1.9.19 | 2+ million | 10 | none known |
| Advanced Custom Fields (ACF®) | 6.8.10 | 2+ million | 14 | none known |
| Advanced Editor Tools | 5.10.1 | 1+ million | 0 | none known |
| Essential Addons for Elementor | 6.8.8 | 1+ million | 74 | none known |
| Code Snippets | 4.0.0 | 1+ million | 8 | none known |
| ElementsKit Elementor Addons | 4.0.9 | 1+ million | 29 | none known |
| Starter Templates | 4.7.10 | 1+ million | 11 | none known |
| Limit Login Attempts Security | 3.3.10 | 1+ million | 4 | none known |
| MC4WP | 4.14.1 | 1+ million | 9 | none known |
| WP Super Cache | 3.1.4 | 1+ million | 3 | none known |
| Loco Translate | 2.8.9 | 1+ million | 9 | none known |
| Disable Comments | 2.9.1 | 1+ million | 1 | none known |
| CookieYes | 3.5.8 | 1+ million | 0 | none known |
| Better Search Replace | 1.4.11 | 1+ million | 2 | none known |
| Hostinger Reach | 1.8.7 | 1+ million | 2 | none known |
| Duplicator | 5.1.0 | 1+ million | 8 | none known |
| Complianz GDPR/CCPA Cookie Consent Banner | 7.5.6 | 1+ million | 10 | none known |
| Speed Optimizer | 7.8.5 | 1+ million | 5 | none known |
| File Manager | 8.0.7 | 1+ million | 18 | none known |
| Loginizer | 2.1.3 | 1+ million | 8 | none known |
| WP Fastest Cache | 1.5.3 | 1+ million | 30 | none known |
| SVG Support | 2.6.3 | 1+ million | 7 | none known |
| AI Agent by SiteGround | 1.3.1 | 1+ million | 1 | none known |
| Custom Post Type UI | 1.19.3 | 1+ million | 3 | none known |
| Security Optimizer | 1.6.9 | 1+ million | 7 | none known |
| Popup Builder & Popup Maker for WordPress | 2.17.1 | 1+ million | 5 | none known |
| Safe SVG | 2.5.2 | 1+ million | 6 | none known |
| WP-Optimize | 4.7.0 | 1+ million | 4 | none known |
| ManageWP Worker | 4.9.38 | 1+ million | 3 | none known |
| XML Sitemap Generator for Google | 4.1.25 | 1+ million | 3 | none known |
| All-In-One Security (AIOS) | 5.5.1 | 1+ million | 23 | none known |
| Image Optimizer | 1.7.7 | 1+ million | 3 | none known |
| Maintenance | 4.32 | 1+ million | 1 | none known |
| EWWW Image Optimizer | 8.9.1 | 1+ million | 12 | none known |
Closed on wordpress.org
- Cookie Information — closed 2024-02-23 (Author Request)
Worried a plugin was already used to break in?
An old plugin is the most common way into a WordPress site. The free scan checks the public side of your site for signs of a hack in about a minute. No login, no install.
Where the data comes from
Plugin versions, update dates and install counts: the wordpress.org Plugins API. Vulnerabilities: CVE records from the NIST National Vulnerability Database, which carry the advisories published by Wordfence, Patchstack and WPScan as the CVE authorities for WordPress. Each entry links to its source. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Questions
How do I know if a WordPress plugin is safe?
Nobody can promise a plugin is safe. What you can check is whether the version you run is inside the range of a known vulnerability, whether the latest release fixes all of them, and whether the plugin still gets updates. Laskyr's plugin pages show all three, with a link to the source for each issue.
Where does the vulnerability data come from?
CVE records from the NIST National Vulnerability Database. For WordPress plugins those records are written by Wordfence, Patchstack and WPScan, which are the CVE authorities for WordPress, and each entry links back to their advisory. Version numbers, update dates and install counts come from the wordpress.org Plugins API.
What does 'no known unpatched vulnerabilities' mean?
It means none of the sources we check list the newest release as affected, as of the date shown. It is not a guarantee. New issues are found every week, which is why updating promptly matters more than any one check.
My plugin version is listed as vulnerable. What now?
Take a backup and update the plugin. If you cannot update right away, deactivate it until you can. If there is no fixed version yet, remove it or replace it. If the site was running the vulnerable version for a while, run a free scan for signs that someone already used it.
Does this cover premium plugins?
Only plugins hosted on wordpress.org can be added for now, because the version data comes from wordpress.org. Searches for premium plugins are recorded so we can see which ones people need.