Plugin Vulnerabilities Customers Helped Make WordPress Plugins More Secure, Week of June 6

WordPress Firewall Plugin Claimed to Protect Against "Any Threat" Doesn't Stop Even One Simulated Attack From Firewall Testing Tool

Patchstack Now Withholding Misappropriated Information Needed to Secure Plugins in WordPress Plugin Directory From WordPress

Plugin Vulnerabilities Customers Helped Make WordPress Plugins More Secure, Week of May 30

The WordPress Meta team holding up the community once again.

With Automattic announcing a return to contributing to WordPress, it's worth noting that there hasn't been a change with the cited reasons they gave for reducing their contributions in January. WP Engine's lawsuit is still on and they haven't boosted their contributions.

WP Engine Study Finds That Security Is Somehow Considered One of WordPress' Benefits and Also Disadvantages

Patchstack tries to get people to report plugin vulnerabilities to them instead of developers or WordPress. Now they are refusing to provide the information to WordPress.

Would anyone guess that this changelog entry for a WordPress plugin with 2+ million installs was referring to fixing a vulnerability?: "Improved context-dependent escaping in dynamic content tags."

"we always take security seriously" - WordPress plugin developer who still hasn't fixed an exploitable vulnerability two months after apparently being notified of it

A WordPress plugin with 100,000 installs has an unfixed vulnerability being targeted by a hacker and Patchstack's response is to suggest you pay them $5 a month for a firewall rule they call a "patch". WordPress could release a real patch for free. We would provide them with the patch for free.

WordPress Plugin Submission Review Seems to Have Failed Badly With ConvertPro

Plugin Vulnerabilities Customers Helped Make WordPress Plugins More Secure, Week of May 23

Long Overdue Security Review of WordPress Would Cost Only 0.25% of WP Engine's Estimate of Cost of One WordPress Website

Mary Hubbard: "Rotating roles can help us avoid centralizing too much authority in any one place, and it guards against the single points of failure that open source and communities should always aim to minimize." Is rotating roles going to apply to her boss Matt Mullenweg?

WordPress Hasn't Addressed Hacker Targeted Plugin With 100,000+ Installs That Has Unfixed "Critical" Vulnerability

8 months after a vulnerability was reported to someone, it still hasn't been fixed. It's unclear what happened here, but the developer claims that the vulnerability was reported to @patchstack.com instead of to them. They say Patchstack made a public claim after 6 months, but didn't notify them.

Is Brizy, Patchstack, or Both to Blame For Lack of Fix for Vulnerable WordPress Plugin With 80,000+ Installs After 8 Months?

They don't mention how many website are using the new plugins. A quick check of our lagging data shows that almost all of the plugins added to the directory this year have under 100 installs. With only slightly over 2% above that. And roughly 83% having under 10 installs.

We have added the FV Gravatar Cache to the roster of WordPress plugins that receive continuous security review from us. That entails us reviewing every update to the plugins for any changes that impact security. If you want a plugin to get the same level coverage, we have a service for that.

The FAQ for the Brizy WordPress plugin tells you to report issues through GitHub and links to a page to do that. If you try to create an issue, it doesn't work with the vague message "Unable to create issue." returned. 1/2

Wordfence Missed That Authenticated Persistent XSS Vulnerability in 2+ Million Install MC4WP: Mailchimp for WordPress Wasn't Fixed

Patchstack VDP Partner WPMU DEV Incompletely Fixed Privilege Escalation Vulnerability in Broken Link Checker

Plugin Security Scorecard April Results

600k WordPress Backup Plugin Claiming to Be "Easiest Way to Protect Your Website" Contains Decade Out of Date Insecure Library

A developer thinks that if you find a vulnerability in their software you shouldn't be able discuss it without their "express consent": "Please do not discuss any vulnerabilities (even resolved ones) without express consent." github.com/timber/timbe...

Hacker Already Targeting Plugin With Vulnerability Exposed by Wordfence Today Without Fix Being Available

Has anyone been told that a WordPress firewall plugin is a solution for distributed denial of service (DDoS) attacks?

Liquid Web doesn't use their own caching plugin, Solid Performance, on their website. They use competitor, W3 Total Cache, instead.

That is coming from the parent of WordPress plugin developer StellarWP. #TheCallIsComingFromInsideTheHouse 1/

Authenticated Information Disclosure Vulnerability in PrettyLinks

WordPress and Security Providers Fail to Make Sure All Plugins Containing Known Vulnerability Have Been Addressed

Someone is trying to exploit a claimed vulnerability in the WordPress plugin WHMpress. We are not using the plugin, but it didn't stop them from trying multiples times despite being blocked each time by our Plugin Vulnerabilities Firewall.

It's 2025 and the Yoast SEO WordPress plugin still doesn't properly uninstall. It leaves behind multiple options and database tables, despite it clearly being stated those should be removed. And @joost.blog thinks he should be in charge of WordPress.

AI slop may have be in use by hackers now.

Is Hacker Using "Hallucinating" AI Chatbot to Create Exploit Attempts Against Non-Existent Vulnerabilities in WordPress Plugins?

As usual, Roger Montti is writing a story on something he doesn't understand and doesn't reach out to a source to help him. Why does @sejournal.bsky.social not do something about this?

Here is Wordfence not be willing to admit that competitor Patchstack disclosed a vulnerability: "plugin publicly disclosed by a third-party CNA on April 30th, 2025." Would be people even know what a CNA is?

So is the WordPress Marketing Team going to be allowed to return?

Full Fix For WordPress Plugin Vulnerability Delayed Over a Year Due Corner Cutting by Claimed Security Researchers

Privilege Escalation Vulnerability in Login Lockdown

WordPress Plugin With 2+ Million Installs Gets Fix For Inability to Be Deleted After Our Service Caught the Problem

What The Malware From Phishing Campaign Targeting WooCommerce Websites With Fake Security Update Does

Wordfence Has Been Conspicuously Ignoring SSRF Security Issue in WordPress While Trying to Get Publicly About Plugins With the Issue

Hacker Incorrectly Trying to Exploit Recently Fixed WordPress Plugin Vulnerability

An update released hours ago for the MonsterInsights WordPress plugin, which is used on over 2 million websites, broke the deletion of the plugin through WordPress. We caught that because of automated testing we do of updates to plugins used by our customers.

Completely contradicting the claim about being tricked into installing, the story says: "Lacking server logs to help identify the exact infection chain, Wordfence hypothesizes the infection occurs via a compromised hosting account or FTP credentials." Is AI writing the @bleepingcomputer.com?

The WordPress Security Team Is Hiding That They Are Failing to Fix Known Security Issues in WordPress

Authenticated Persistent Cross-Site Scripting (XSS) Vulnerability in Download Manager