Plugin Vulnerabilities

pluginvulnerabilities.comPlugin Vulnerabilities Customers Helped Make WordPress Plugins More Secure, Week of June 6

6 June 2025

Plugin Vulnerabilities Customers Helped Make WordPress Plugins More Secure, Week of June 6

pluginvulnerabilities.comWordPress Firewall Plugin Claimed to Protect Against “Any Threat” Doesn’t Stop Even One Simulated Attack From Firewall Testing Tool

3 June 2025

WordPress Firewall Plugin Claimed to Protect Against "Any Threat" Doesn't Stop Even One Simulated Attack From Firewall Testing Tool

pluginvulnerabilities.comPatchstack Now Withholding Misappropriated Information Needed to Secure Plugins in WordPress Plugin Directory From WordPress

Patchstack Now Withholding Misappropriated Information Needed to Secure Plugins in WordPress Plugin Directory From WordPress

pluginvulnerabilities.comPlugin Vulnerabilities Customers Helped Make WordPress Plugins More Secure, Week of May 30

Plugin Vulnerabilities Customers Helped Make WordPress Plugins More Secure, Week of May 30

make.wordpress.orgUpdate on the GatherPress project – May 2025We were invited to give regular updates about GatherPress. Here are the advancements made by GatherPress since our initial proposal from January 2024 and our update from September 2024. The GatherP…

The WordPress Meta team holding up the community once again.

Latest WordPress News@wpnews.bsky.social

Update on the GatherPress project – May 2025

automattic.comAligning Automattic’s Sponsored Contributions to WordPressAutomattic has always been deeply committed to the success of WordPress, dedicating significant resources and talent to its development for almost two decades. However, we’ve observed an imbalance …

With Automattic announcing a return to contributing to WordPress, it's worth noting that there hasn't been a change with the cited reasons they gave for reducing their contributions in January. WP Engine's lawsuit is still on and they haven't boosted their contributions.

pluginvulnerabilities.comA Month On, a Glaring Problem With Five for the Future Pledges Hasn’t Been Addressed

Also worth re-upping is that Five for the Future pledges are in general highly suspect. It is one of the many things that are need of reform with WordPress.

pluginvulnerabilities.comWP Engine Study Finds That Security Is Somehow Considered One of WordPress’ Benefits and Also Disadvantages

28 May 2025

WP Engine Study Finds That Security Is Somehow Considered One of WordPress' Benefits and Also Disadvantages

wordpress.orgSecurity vulnerabilitySecurity vulnerability Resolved Artan (@artankrasniqi1988) 1 day, 9 hours ago Hi, wordfence reported a high level vulnerability: Had to uninstall the plugin for now. Hope a fix comes so I can react…

Patchstack tries to get people to report plugin vulnerabilities to them instead of developers or WordPress. Now they are refusing to provide the information to WordPress.

View full thread

The US Government through their funding of CVE is also supporting this.

pluginvulnerabilities.comPatchstacks’s Vulnerability Disclosure Program (VDP) Goes Against Important Requirements of EU’s Cyber Resilience Act

Patchstack are claiming the EU Cyber Resilience Act (CRA) requires this. It isn't the first time they have lied about that act.

Patchstack tries to get people to report plugin vulnerabilities to them instead of developers or WordPress. Now they are refusing to provide the information to WordPress.

wptavern.comPatchstack Secures $5M in Series A FundingPatchstack, a leading WordPress security company, recently raised $5 million in its Series A funding round. The funding round was led by Karma Ventures, G+D Ventures, and Emilia Capital, an investm…

Joost de Valk (@joost.blog) is funding what is basically a man-in-the-middle (MiTM) attack against WordPress.

Would anyone guess that this changelog entry for a WordPress plugin with 2+ million installs was referring to fixing a vulnerability?: "Improved context-dependent escaping in dynamic content tags."

pluginvulnerabilities.comWordfence Missed That Authenticated Persistent XSS Vulnerability in 2+ Million Install MC4WP: Mailchimp for WordPress Wasn’t Fixed

We provided our customers with the details of the vulnerability last week.

wordpress.orgSecurity vulnerabilitySecurity vulnerability Resolved Artan (@artankrasniqi1988) 1 day, 7 hours ago Hi, wordfence reported a high level vulnerability: Had to uninstall the plugin for now. Hope a fix comes so I can react…

"we always take security seriously" - WordPress plugin developer who still hasn't fixed an exploitable vulnerability two months after apparently being notified of it

patchstack.comUnpatched Critical Vulnerability in TI WooCommerce Wishlist Plugin - Patchstack🚨 A critical unpatched vulnerability in the TI WooCommerce Wishlist plugin allows unauthenticated file uploads and potential RCE. Over 100K sites affected. As usual, Patchstack users are protected. 🛡️

A WordPress plugin with 100,000 installs has an unfixed vulnerability being targeted by a hacker and Patchstack's response is to suggest you pay them $5 a month for a firewall rule they call a "patch". WordPress could release a real patch for free. We would provide them with the patch for free.

pluginvulnerabilities.comWordPress Hasn’t Addressed Hacker Targeted Plugin With 100,000+ Installs That Has Unfixed “Critical” Vulnerability

Patchstack claimed today that over 100,000 websites are affected, but as we noted last week, it is significantly less than that.

pluginvulnerabilities.comWordPress Plugin Submission Review Seems to Have Failed Badly With ConvertPro

23 May 2025

WordPress Plugin Submission Review Seems to Have Failed Badly With ConvertPro

pluginvulnerabilities.comPlugin Vulnerabilities Customers Helped Make WordPress Plugins More Secure, Week of May 23

23 May 2025

Plugin Vulnerabilities Customers Helped Make WordPress Plugins More Secure, Week of May 23

pluginvulnerabilities.comLong Overdue Security Review of WordPress Would Cost Only 0.25% of WP Engine’s Estimate of Cost of One WordPress Website

23 May 2025

Long Overdue Security Review of WordPress Would Cost Only 0.25% of WP Engine's Estimate of Cost of One WordPress Website

make.wordpress.orgRestoring Trust while Preserving SafetyIn April, @matt wrote about reflection; how, after twenty years, WordPress is still growing, not just in code and contributors, but in responsibility. The Jubilee post invited us to pause and ask w…

22 May 2025

Mary Hubbard: "Rotating roles can help us avoid centralizing too much authority in any one place, and it guards against the single points of failure that open source and communities should always aim to minimize." Is rotating roles going to apply to her boss Matt Mullenweg?

Latest WordPress News@wpnews.bsky.social

Restoring Trust while Preserving Safety

22 May 2025

Mary Hubbard goes on to say "If we continue to center empathy, transparency, and the shared goal of making WordPress better for everyone, we won’t just be stronger. We’ll be ready for whatever comes next." When has WordPress centered transparency?

pluginvulnerabilities.comWordPress Hasn’t Addressed Hacker Targeted Plugin With 100,000+ Installs That Has Unfixed “Critical” Vulnerability

22 May 2025

WordPress Hasn't Addressed Hacker Targeted Plugin With 100,000+ Installs That Has Unfixed "Critical" Vulnerability

pluginvulnerabilities.comIs Brizy, Patchstack, or Both to Blame For Lack of Fix for Vulnerable WordPress Plugin With 80,000+ Installs After 8 Months?

8 months after a vulnerability was reported to someone, it still hasn't been fixed. It's unclear what happened here, but the developer claims that the vulnerability was reported to @patchstack.com instead of to them. They say Patchstack made a public claim after 6 months, but didn't notify them.

Plugin Vulnerabilities@pluginvulns.bsky.social

Is Brizy, Patchstack, or Both to Blame For Lack of Fix for Vulnerable WordPress Plugin With 80,000+ Installs After 8 Months?

pluginvulnerabilities.comIs Brizy, Patchstack, or Both to Blame For Lack of Fix for Vulnerable WordPress Plugin With 80,000+ Installs After 8 Months?

Is Brizy, Patchstack, or Both to Blame For Lack of Fix for Vulnerable WordPress Plugin With 80,000+ Installs After 8 Months?

make.wordpress.orgThe WordPress Ecosystem is Growing: New Plugin Submissions Have Doubled in 2025This year, the number of plugins submitted has grown by 87% compared to last year 🌱 We have great news from the Plugins team. The submission of new plugins in WordPress has almost doubled this year…

They don't mention how many website are using the new plugins. A quick check of our lagging data shows that almost all of the plugins added to the directory this year have under 100 installs. With only slightly over 2% above that. And roughly 83% having under 10 installs.

Latest WordPress News@wpnews.bsky.social

The WordPress Ecosystem is Growing: New Plugin Submissions Have Doubled in 2025

Does WordPress really need a lot more plugins or does it need better plugins?

pluginvulnerabilities.comContinuous WordPress Plugin Security Review Service

We have added the FV Gravatar Cache to the roster of WordPress plugins that receive continuous security review from us. That entails us reviewing every update to the plugins for any changes that impact security. If you want a plugin to get the same level coverage, we have a service for that.

github.comPull requests · ThemeFuse/BrizyBrizy is the most user-friendly visual page builder in town! No designer or developer skills required. The only tools you'll need to master are clicks and drags. - Pull requests · ThemeFuse/Brizy

The FAQ for the Brizy WordPress plugin tells you to report issues through GitHub and links to a page to do that. If you try to create an issue, it doesn't work with the vague message "Unable to create issue." returned. 1/2

Looking at the underlying response sent from GitHub, it actually contains a clear explanation, "Issues has been disabled in this repository." Why is @github.com making the issue reporting form available in that situation and why isn't it showing the clear explanation when submission fails? 2/2

pluginvulnerabilities.comWordfence Missed That Authenticated Persistent XSS Vulnerability in 2+ Million Install MC4WP: Mailchimp for WordPress Wasn’t Fixed

19 May 2025

Wordfence Missed That Authenticated Persistent XSS Vulnerability in 2+ Million Install MC4WP: Mailchimp for WordPress Wasn't Fixed

pluginvulnerabilities.comPatchstack VDP Partner WPMU DEV Incompletely Fixed Privilege Escalation Vulnerability in Broken Link Checker

17 May 2025

Patchstack VDP Partner WPMU DEV Incompletely Fixed Privilege Escalation Vulnerability in Broken Link Checker

pluginvulnerabilities.comPlugin Security Scorecard April Results

16 May 2025

Plugin Security Scorecard April Results

pluginvulnerabilities.com600k WordPress Backup Plugin Claiming to Be “Easiest Way to Protect Your Website” Contains Decade Out of Date Insecure Library

15 May 2025

600k WordPress Backup Plugin Claiming to Be "Easiest Way to Protect Your Website" Contains Decade Out of Date Insecure Library

A developer thinks that if you find a vulnerability in their software you shouldn't be able discuss it without their "express consent": "Please do not discuss any vulnerabilities (even resolved ones) without express consent." github.com/timber/timbe...

pluginvulnerabilities.comHacker Already Targeting Plugin With Vulnerability Exposed by Wordfence Today Without Fix Being Available

Hacker Already Targeting Plugin With Vulnerability Exposed by Wordfence Today Without Fix Being Available

Has anyone been told that a WordPress firewall plugin is a solution for distributed denial of service (DDoS) attacks?

Liquid Web doesn't use their own caching plugin, Solid Performance, on their website. They use competitor, W3 Total Cache, instead.

liquidweb.com1 in 3 WordPress Users Report Plugin Fatigue — Here's WhyPlugin fatigue is driving users away — and back. Discover what’s causing the overwhelm and how smarter hosting solves it.

That is coming from the parent of WordPress plugin developer StellarWP. #TheCallIsComingFromInsideTheHouse 1/

Latest WordPress News@wpnews.bsky.social

1 in 3 WordPress Users Report Plugin Fatigue — Here's Why

View full thread

pluginvulnerabilities.comWordPress Plugin Developer Security Advisory: StellarWP

Liquid Web could do something about this, as among other issues, StellarWP keeps releasing incomplete security fixes for one of their plugins. Hiring someone to security reviews could get those issue fixed once, but they don't do that. 3/

Instead their response is to suggest spending more money on web hosting: "Hosting that handles plugin updates and scans for vulnerabilities lets users enjoy the power of WordPress without the pressure." (Their vulnerability scanning clearly doesn't work, as can be see by their own plugins.) 4/

liquidweb.com1 in 3 WordPress Users Report Plugin Fatigue — Here's WhyPlugin fatigue is driving users away — and back. Discover what’s causing the overwhelm and how smarter hosting solves it.

That is coming from the parent of WordPress plugin developer StellarWP. #TheCallIsComingFromInsideTheHouse 1/

Latest WordPress News@wpnews.bsky.social

1 in 3 WordPress Users Report Plugin Fatigue — Here's Why

They had this to say about WordPress plugins: "Plugin fatigue – the frustration users feel from maintaining too many plugins – often results from constant updates, compatibility issues, performance slowdowns, unexpected security vulnerabilities, and rising costs." 2/

pluginvulnerabilities.comAuthenticated Information Disclosure Vulnerability in PrettyLinks

Authenticated Information Disclosure Vulnerability in PrettyLinks

pluginvulnerabilities.comWordPress and Security Providers Fail to Make Sure All Plugins Containing Known Vulnerability Have Been Addressed

WordPress and Security Providers Fail to Make Sure All Plugins Containing Known Vulnerability Have Been Addressed

Someone is trying to exploit a claimed vulnerability in the WordPress plugin WHMpress. We are not using the plugin, but it didn't stop them from trying multiples times despite being blocked each time by our Plugin Vulnerabilities Firewall.