The Most Dangerous WordPress Plugin Vulnerabilities of 2025–2026 (And How to Check Yours)
In 2025, researchers disclosed 11,334 WordPress vulnerabilities — 91% in plugins, not core. Attackers reached mass exploitation of critical flaws in as little as 5 hours after disclosure. Here's what broke, what it means, and a two-minute way to check your exposure.
The Scale of the Problem
In 2025, security researchers disclosed 11,334 WordPress vulnerabilities — a 42% increase over 2024. Of those:
- •91% were in plugins and themes, not WordPress core
- •3,200 were rated High or Critical severity
- •Median time from disclosure to mass exploitation: 5 hours
- •Average number of active installs affected per critical plugin CVE: 1.2 million
Source: Patchstack State of WordPress Security 2026
The Biggest Vulnerabilities: 2025–2026
LiteSpeed Cache — XSS Vulnerability (7 Million Sites)
CVE: CVE-2025-12450 | Severity: High (CVSS 8.3)
LiteSpeed Cache is the most popular WordPress caching plugin, installed on over 7 million sites. A stored XSS vulnerability allowed unauthenticated attackers to inject malicious JavaScript into cached pages — which then executed for every visitor who loaded that page from cache.
What an attacker could do: Steal admin session cookies, inject cryptomining scripts, redirect visitors, deface the site.
Affected versions: All versions below 6.5.1
Patched in: 6.5.1 (released December 2025)
Source: Cryptika Security Research
Ally Plugin — Unauthenticated SQL Injection (400,000 Sites)
CVE: CVE-2026-2413 | Severity: Critical (CVSS 9.8)
An unauthenticated SQL injection in the Ally accessibility plugin allowed attackers with no login credentials to extract the entire WordPress database — including user password hashes, email addresses, WooCommerce orders, and all custom data.
SQL injection doesn't need a logged-in account. An attacker can run this from a script in seconds:
# Example of what an automated exploit attempt looks like (simplified):
# Sends a specially crafted request to the vulnerable endpoint
curl -s "https://targetsite.com/wp-admin/admin-ajax.php" \
-d "action=ally_get_data&id=1 UNION SELECT user_login,user_pass FROM wp_users--"Affected versions: Ally 3.x below 3.0.8
Status: 47.9% of sites were still running the vulnerable version 3 weeks after patch release.
Source: Wordfence Advisory
WP Maps Pro — Time-Based Blind SQL Injection
CVE: CVE-2026-3222 | Severity: High (CVSS 8.8)
An unusual SQL injection using backtick character injection bypassed standard parameterised query implementations. The technique allowed authenticated attackers (subscriber-level accounts) to extract database contents through time-based blind injection.
Notable because the vulnerability bypassed prepared statement usage — illustrating that parameterised queries alone don't guarantee SQL injection protection if string interpolation is used elsewhere in the query construction.
Quiz and Survey Master (QSM) — SQL Injection (40,000 Sites)
CVE: CVE-2025-67987 | Severity: Critical (CVSS 9.8)
An unauthenticated SQL injection in QSM's quiz result endpoint allowed full database extraction. 40,000 active installs affected.
The exploitation timeline was particularly stark: the vulnerability was disclosed on a Monday, weaponised exploit code appeared on exploit-db.com on Tuesday, and widespread automated scanning of WordPress sites began Wednesday. Sites that hadn't updated by Thursday were being actively targeted.
LA-Studio Element Kit — Backdoor (CVSS 9.8)
A former employee at LA-Studio inserted a deliberately hidden backdoor into the Element Kit plugin during their last weeks of employment. The backdoor created a hidden admin account accessible via a specific URL parameter.
This is classified as a supply chain attack from inside the development team — and it went undetected for 4 months before being discovered by a security researcher conducting a routine code audit.
Why 91% Are In Plugins (Not Core)
WordPress core has a dedicated security team with mandatory code review, automated scanning, and a formal CVE disclosure process. A vulnerability in WordPress core gets fixed and deployed to hundreds of millions of sites within hours.
Plugins have no such mandate. A plugin author might be:
- •A solo developer who hasn't touched the code in 18 months
- •A company that just sold the plugin portfolio to an unknown buyer
- •Running PHP code written in 2015 with no modern security practices
The quality gap is enormous — and attackers know exactly where to focus.
How to Know If You're Running a Vulnerable Plugin
Method 1: External Vulnerability Scan (Recommended)
Run your site through wp-scan.org/malware-check
The scan cross-references your site's installed plugins and versions against the current vulnerability database. It flags:
- •Installed plugins with known CVEs
- •The specific version you're running vs. the patched version
- •Severity rating so you can prioritise
This works even if you don't know what version a plugin is running — the scanner detects it from outside.
Method 2: WordPress Dashboard (Manual)
WordPress Admin → Dashboard → Updates
This shows available updates but won't catch zero-day vulnerabilities or supply chain attacks.
Method 3: Patchstack / WPVulnDB
- •patchstack.com/database — searchable CVE database for WordPress
- •wpscan.com/plugins — WPScan vulnerability database (separate project from wp-scan.org)
The Update Discipline Framework
Given the 5-hour exploitation window, "I'll update it this weekend" is genuinely risky for high-severity vulnerabilities.
Practical framework:
Critical (CVSS 9+): Update same day as notification. Period.
High (CVSS 7-8.9): Update within 48 hours.
Medium (CVSS 4-6.9): Update within 7 days.
Low (CVSS <4): Include in next scheduled maintenance.For automatic updates, enabling them for all plugins is far less risky than the alternative:
// wp-config.php or functions.php:
// Auto-update all plugins (recommended for security releases):
add_filter('auto_update_plugin', '__return_true');The counterargument — "auto-updates might break my site" — is valid. But a 5-hour exploitation window after a Critical CVE disclosure is a genuine and immediate threat. Test in staging if you're worried about compatibility, but don't delay critical updates.
The Abandoned Plugin Problem
A plugin that hasn't been updated in 12+ months is a red flag. It means:
- •The author may not be monitoring vulnerability disclosures
- •The code may not be compatible with current PHP/WordPress versions
- •If sold, the new owner's intentions are unknown (see: supply chain attacks)
Rule of thumb: if a plugin hasn't been updated in 12 months and has under 1,000 active installs, delete it. It's more attack surface than it's worth.
The One-Scan Check
The fastest way to know your plugin exposure is the external scan:
Run it now. It takes 60 seconds and shows you precisely which installed plugins have known CVEs — without requiring access to your WordPress dashboard or any plugin installation.
Free external scan — 22 checks, instant report. No plugin, no account.
Run Free Scan → wp-scan.org/malware-checkBuilder of wp-scan.org — a free external WordPress malware scanner trusted by thousands of site owners. With 9+ years building and securing WordPress products, Rajan writes practical security guides based on real attack patterns he's encountered. You can find more of his work at rajangupta.com.
📬 Enjoyed this article?
Get the next one in your inbox — free WordPress security guides, weekly.
