Denial of service in WordPress plugins
A denial of service bug lets someone make your site slow or unavailable, for example by sending a request that makes the plugin do a huge amount of work or fill the disk.
Nobody gets into your site this way, but downtime costs visitors and sales, and on shared hosting it can get the account suspended for using too many resources.
What to do: update the plugin. A caching layer or firewall in front of the site absorbs much of this kind of traffic.
Worried a plugin bug was used on your site?
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Newest Denial of service records
42 on record for the plugins we track. Data as of 2026-11-04.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
-
high 7.5 Formidable Forms
Denial of service
-
medium 6.5 WPBase Cache
Denial of service
-
high 7.5 WP Ultimate Review
Denial of service
-
high 7.5 WP Ultimate Review
Denial of service
-
high 7.5 OMGF
Denial of service
-
medium 5.9 WP Store Locator
Denial of service
-
medium 5.3 Two Factor
Denial of service
-
high 8.2 WP Recipe Maker
Denial of service
-
medium 5.3 Really Simple Security
Denial of service
-
medium 5.7 Seraphinite Accelerator
Denial of service
-
high 7.5 WooCommerce
Denial of service
-
high 7.5 MalCare WordPress Security Plugin
Denial of service
-
high 7.5 Migrate Guru
Denial of service
-
medium 5.3 Really Simple Security
Denial of service
-
medium 5.3 WP Go Maps
Denial of service
-
high 7.5 Smush
Denial of service
-
medium 6.8 Shared Files
Denial of service
-
high 7.5 Kadence Starter Templates
Denial of service
-
medium 6.5 WP Maps
Denial of service
-
medium 5.3 Simply Schedule Appointments
Denial of service
-
medium 5.5 HTTP Headers
Denial of service
-
high 7.5 Comments
Denial of service
-
high 8.1 10Web Booster
Denial of service
-
medium 5.3 Email Subscribers & Newsletters by Icegram Exp…
Denial of service
-
medium 5.3 Crypto
Denial of service
-
medium 5.3 Calculated Fields Form
Denial of service
-
medium 5.3 Minify HTML
Denial of service
-
high 8.1 Image Optimizer, Resizer and CDN
Denial of service
-
medium 4.3 Premium Addons for Elementor
Denial of service
-
medium 5.3 Kadence Security
Denial of service
-
medium 6.5 Code Embed
Denial of service
-
high 7.5 Backuply
Denial of service
-
high 7.1 Woostify Sites Library
Denial of service
-
medium 6.5 Quiz Maker by AYS
Denial of service
-
medium 6.5 Essential Real Estate
Denial of service
-
medium 5.3 Ninja Forms
Denial of service
-
critical 9.1 10Web Booster
Denial of service
-
medium 6.5 Better Messages
Denial of service
-
high 7.3 Jupiter X Core
Denial of service
-
medium 6.5 OTP Login With Phone Number, OTP Verification
Denial of service
-
high 7.5 Safe SVG
Denial of service
-
high 7.5 Safe SVG
Denial of service
Other types
Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution · Arbitrary file upload · Path traversal and file read · Authentication bypass · File inclusion · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Content injection
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.