Daniel Lasek · Last reviewed 2026-11-01
Is My WordPress Plugin Safe? Plugin Vulnerability Lookup
Most hacked WordPress sites are broken into through a plugin that was not updated. The fix had usually been out for weeks. The plugin lookup answers the question site owners actually ask, "is this plugin safe?", in the only honest way: here is the latest version, here is every known vulnerability and which versions it affects, and here is whether the newest release still has an open one.
What a plugin page shows
Each plugin page lists the latest version, the date of the last release, and how many sites run it, straight from wordpress.org. Below that is every known vulnerability we could match to that exact plugin: the kind of issue in plain words, the affected version range, the version that fixed it, how severe it is, and whether an attacker needs to be logged in. Each entry links to its CVE record and to the advisory from Wordfence, Patchstack or WPScan.
At the top, one sentence sums it up with a date. For example: "No known unpatched vulnerabilities in the latest version (4.3.5) as of 2026-11-01." We never print "safe", because a clean record today says nothing about the bug found tomorrow.
How to use it
Find out which version you run: Plugins in the WordPress dashboard shows it under each plugin name, or run wp plugin get <slug> --field=version. Type that version into the "Check your version" box on the plugin page. If it falls inside a known range, update. If the plugin has been closed on wordpress.org, replace it, because it will not get fixes through WordPress any more.
Why matching CVEs to plugins is careful work
CVE records do not always name the wordpress.org slug, and different plugins can have very similar names. Laskyr only lists a CVE on a plugin page when its references or the CVE authority's own data point to that exact plugin. That means a few real issues can be missing, but an issue for a different plugin should never appear. If you spot a mistake, email Daniel and it gets fixed.
If a vulnerable version was already live
Updating closes the door, but it does not remove anything an attacker already left behind. Run the free scan to check the public side of the site. If it finds signs of a hack, the Emergency Cleanup is a flat $499.
Read-only scan · No install · Results in about 30 seconds
Questions
How do I know if a WordPress plugin is safe?
Nobody can promise a plugin is safe. What you can check is whether the version you run is inside the range of a known vulnerability, whether the latest release fixes all of them, and whether the plugin still gets updates. Laskyr's plugin pages show all three, with a link to the source for each issue.
Where does the vulnerability data come from?
CVE records from the NIST National Vulnerability Database. For WordPress plugins those records are written by Wordfence, Patchstack and WPScan, which are the CVE authorities for WordPress, and each entry links back to their advisory. Version numbers, update dates and install counts come from the wordpress.org Plugins API.
What does 'no known unpatched vulnerabilities' mean?
It means none of the sources we check list the newest release as affected, as of the date shown. It is not a guarantee. New issues are found every week, which is why updating promptly matters more than any one check.
My plugin version is listed as vulnerable. What now?
Take a backup and update the plugin. If you cannot update right away, deactivate it until you can. If there is no fixed version yet, remove it or replace it. If the site was running the vulnerable version for a while, run a free scan for signs that someone already used it.
Does this cover premium plugins?
Only plugins hosted on wordpress.org can be added for now, because the version data comes from wordpress.org. Searches for premium plugins are recorded so we can see which ones people need.