PatchTheCVEwpplugins vulnerabilities
Recent CVEs affecting wpplugins products. 5 tracked.
wpplugins has 5 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2025-03-27. Highest priority: CVE-2024-6420 (score 60/100).
- CVE-2025-2056 HIGH 7.5 UPGRADE The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in
- CVE-2025-26909 CRITICAL 9.6 UPGRADE Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
- CVE-2024-6420 HIGH 8.6 UPGRADE The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_
- CVE-2024-13794 MEDIUM 5.3 UPGRADE The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcos
- CVE-2024-10825 MEDIUM 6.1 UPGRADE The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scriptin
FAQ
How do I fix wpplugins vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is wpplugins being exploited right now?
None of the tracked wpplugins CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which wpplugins CVE should I patch first?
CVE-2024-6420 currently ranks highest (60/100): The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_.