WordPress plugins with known vulnerabilities

What we check

If the website runs on WordPress, we read from the addresses of the files that the home page loads which plugins are in use and in which version. Typical are addresses such as /wp-content/plugins/contact-form-7/…?ver=5.7.1.

We compare these plugins and versions with the public database of wpvulnerability.net:

• Plugins with known vulnerabilities we report with the severity (CVSS, 10 = most severe) and the version that closes the vulnerability.
• Plugins that WordPress has removed from its directory we report as well. As a rule they no longer receive updates.

For this we request no additional files on the server. The version is a pointer: some plugins give no version or a different one in the file addresses. Plugins that work only in the administration area or on subpages are not seen by us.

Why it matters

WordPress itself is well maintained. Most successful attacks on WordPress websites go through outdated plugins and themes.

The sequence is almost always the same: a vulnerability in a plugin becomes known and is published. Within hours to days automated programs search the internet for websites with the affected version. Anyone who has not installed the update is attacked, regardless of size or industry.

A hacked WordPress website

• distributes malware to the visitors,
• redirects to fraud or gambling pages, often only for visitors from Google, so that the operator does not notice it,
• sends spam through the server,
• ends up on blocklists of Google and browsers, which then warn against the page.

Cleaning up usually costs many times the price of regular maintenance.

How to fix it

1. Create a backup. Before you update anything, back up files and database, e.g. with UpdraftPlus or through the hosting provider.
2. Update plugins. In the WordPress backend under "Plugins" you see where updates are available. Update at least to the version named in the report.
3. Replace removed or abandoned plugins. If there is no update that closes the vulnerability, look for a maintained plugin with the same function and delete the old one.
4. Clean up. Delete deactivated and unused plugins and themes. Deactivated code can be vulnerable too.
5. Switch on automatic updates. Since WordPress 5.5 you can choose "Enable auto-updates" for each plugin in the plugin list.

Premium plugins and themes

Purchased plugins, such as page builders or sliders from a theme package, often update only with a valid licence. If the licence has expired, they stay at the old version. Renew the licence or replace the plugin.

Outsource maintenance

Many agencies and hosting providers offer WordPress maintenance at a monthly price: updates, backups and monitoring. For companies without technical resources of their own this is usually the safest solution.

How to check it yourself

The dashboard and "Tools › Site Health" show pending updates. Security plugins such as Wordfence or WPScan report known vulnerabilities directly in the backend.

Frequently asked questions

Are automatic updates for all plugins advisable?

For well-maintained plugins, yes. The risk that an update breaks something is usually smaller than the risk of an open vulnerability. A regular backup is important so that it is possible to go back in an emergency.

The website does not use WordPress. Does this apply to it?

No. If we do not detect WordPress, this check does not apply. Other systems are covered by the check "Outdated software".

How many plugins are too many?

There is no fixed limit. Every plugin is additional code that has to be maintained, though. Everything that is not actively used should be removed, deactivated plugins too.