Keeping WordPress safe
Abandoned plugins and plugins with CVEs
Every plugin is code from someone else running on your site. Most are fine. A few are abandoned, and some have published security holes. This is how to tell the difference, and what to do.
Before you install a plugin
Open the plugin's page on wordpress.org/plugins and check:
| Check | Good sign | Warning sign |
|---|---|---|
| Last updated | Within the last few months | More than a year ago |
| Tested up to | The current WordPress version | Several versions behind |
| Active installations | Thousands or more | A handful, and no reviews |
| Support forum | Recent questions with replies from the author | Months of unanswered threads |
| Notices at the top of the page | None | A yellow or red box (see below) |
Signs a plugin has been abandoned
- Yellow notice on wordpress.org: "This plugin hasn't been tested with the latest 3 major releases of WordPress. It may no longer be maintained or supported and may have compatibility issues." Treat this as a reason to look for a replacement.
- Red notice: "This plugin has been closed and is no longer available for download." Plugins are closed for many reasons, including unfixed security problems. If you have a closed plugin installed, replace it.
- No updates in a year or more, and an author who no longer answers.
Source: WordPress.org plugin alerts and warnings.
What a CVE is
A CVE (Common Vulnerabilities and Exposures) is a public ID number for a known security hole, for example CVE-2026-12345. When a plugin has a CVE, the details of the hole are published, and attackers start scanning for sites that have not updated, often within days. A CVE in a plugin you use is therefore urgent, but usually easy to fix: update to the version that patches it.
Where to look a plugin up
- CVE.org: the official CVE list. Type the plugin name in the search box.
- Wordfence Intelligence: a free database of WordPress plugin and theme vulnerabilities, with the affected and fixed versions.
- WPScan: another WordPress vulnerability database, searchable by plugin.
- Patchstack: a third database, often the first to publish WordPress plugin issues.
You do not have to check these by hand every week. The Kadence Security site scan compares your installed versions with a vulnerability database and e-mails you when one matches.
A plugin you use has a CVE: what to do
- Check the fixed version. The database entry says which versions are affected and which version fixes it.
- Update now if a fixed version exists. Do not wait for the weekend.
- No fix yet? Deactivate the plugin and, if you can live without it for a while, delete it. A deactivated plugin's files can still sometimes be reached directly.
- Look for signs of trouble if the hole was being exploited before you updated: new administrator accounts under Users, pages you did not create, or files you do not recognise. Run a site scan.
- Replace plugins whose authors take months to fix published holes.
Fewer plugins, fewer problems
- Delete plugins you have deactivated. Inactive code is still on your server.
- One plugin per job. Two caching or two security plugins fight each other.
- Prefer plugins from companies with a track record (the five on our recommended list are all actively maintained).
- Only install from wordpress.org or the author's own site, never from file-sharing or "free premium" download sites.
Rather have us do it for you?
Precision Web Hosting builds, secures and hosts WordPress sites with every setting on this site already done. Tell us about your project and we will send you a quote.