Plugin security advisories left unpatched
Security advisories for the plugin, including cross-site scripting and request forgery, stay open for weeks with no patch and no public status.
Tier II · Emerging Problems that are still building up.
4 public reports · first reported 21 March 2023 · last reported 22 February 2026
What's going wrong
Site owners say that security scanners such as Patchstack, Malcare and iThemes Security flagged the plugin for cross-site scripting and cross-site request forgery flaws, and that the flaws stayed open for weeks.
AI-assisted: written with the help of AI from the reports. The idea report has the full summary.
In the idea report
- The full summary.
- The products the 4 reports are about, and how many came each month.
- Related problems.
No business has been found with this problem yet, so the report has no contacts. All sales are final — no refunds. Pricing.