How many CVEs have a located fix in wordpress-plugins/plugins?

851 published CVEs have a fix traced to functions in wordpress-plugins/plugins, touching 9,046 functions across 6,107 files.

Which function in wordpress-plugins/plugins has been patched by the most CVEs?

number in media-library-assistant/trunk/includes/class-mla-core.php has been changed by 5 CVE fixes, from 2025 to 2026.

How large is a typical CVE fix in wordpress-plugins/plugins?

The median fix changes 86 lines. 25% of fixes change 20 lines or fewer, and 5% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

php

javascript

#2 of 500 repositories

wordpress-plugins/plugins

Name: wordpress-plugins/plugins: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix October 10, 2026

851

CVE fixes located

Published CVEs

9,046

Functions patched

Distinct function sites

6,107

Files patched

Distinct source files

2012–2026

Years covered

By CVE publication date

Overview

851 published CVEs have a fix traced to functions in wordpress-plugins/plugins, the earliest published in 2012. Those fixes changed 9,046 distinct functions across 6,107 files, in 19,998 patch hunks.

Among the 500 repositories tracked here, wordpress-plugins/plugins ranks #2 by the number of CVEs with a located fix.

Most patched functions

Functions in wordpress-plugins/plugins changed by the most CVE fixes.

Most patched files

Files in wordpress-plugins/plugins changed by the most CVE fixes.

1download-manager/trunk/download-manager.php9 CVEs · 0 functions
2profilegrid-user-profiles-groups-and-communities/trunk/includes/class-profile-magic-request.php6 CVEs · 11 functions
3wp-file-upload/trunk/lib/wfu_security.php6 CVEs · 8 functions
4wp-file-upload/trunk/lib/wfu_processfiles.php6 CVEs · 2 functions
5profilegrid-user-profiles-groups-and-communities/trunk/profile-magic.php6 CVEs · 1 functions
6drag-and-drop-multiple-file-upload-contact-form-7/trunk/inc/dnd-upload-cf7.php5 CVEs · 20 functions
7profilegrid-user-profiles-groups-and-communities/trunk/includes/class-profile-magic-chat-system.php5 CVEs · 9 functions
8profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php5 CVEs · 4 functions
9ameliabooking/trunk/ameliabooking.php5 CVEs · 2 functions
10file-manager-advanced/trunk/file_manager_advanced.php5 CVEs · 1 functions

Fix size

How much code a CVE fix in wordpress-plugins/plugins changes, with backports counted once.

86

Median lines changed

Added plus removed, per CVE

25%

Fixes of 20 lines or fewer

Share of CVE fixes

5%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in wordpress-plugins/plugins, and the functions each fix changed.

Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
CVE-2026-103897delete_url_caches replace_link_title lightbox_gallery_link
Medium · CVSS 4.4
EPSS 0.2%2026-10-10
Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
CVE-2026-91862
Medium · CVSS 6.4
EPSS 0.2%2026-10-10
WPMobile.App /0' Path Segment
CVE-2026-103421wpappninja_show_stats wpappninja_stats_log
Medium · CVSS 5.4
EPSS 0.2%2026-10-03
SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
CVE-2026-92174sanitize_field_input init remove_post_type_filter
High · CVSS 7.5
EPSS 0.6%2026-10-02
eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter
CVE-2026-77193ID2WP_Admin ID2WP_Access_Controller ID2WP_Handler
High · CVSS 7.5
EPSS 0.4%2026-09-24
RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action
CVE-2026-4123slick injectNavVideoIcons SlickLightbox
Medium · CVSS 4.3
EPSS 0.4%2026-09-22
WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter
CVE-2026-7527check_admin_referer
Medium · CVSS 4.7
EPSS 0.4%2026-09-19
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
CVE-2026-9232each easy_ea_blocks_render_shortcode easy_ea_create_block_init
Medium · CVSS 6.5
EPSS 0.5%2026-09-19
Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function
CVE-2026-15946extract_destination Metasync_Otto_Job_Status update_page
Medium · CVSS 4.3
EPSS 0.2%2026-09-19
Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter
CVE-2026-15947extract_destination Metasync_Otto_Job_Status update_page
Medium · CVSS 4.3
EPSS 0.2%2026-09-19
PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler
CVE-2026-11899GetInvoiceDetail
Medium · CVSS 4.3
EPSS 0.2%2026-09-19
Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover
CVE-2026-14311activation init
Medium · CVSS 5.4
EPSS 0.2%2026-09-17

Get an alert for each new wordpress-plugins/plugins CVE, with the patched functions and AI-written analysis.

Monitor plugins CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

tensorflow/tensorflow411 CVEs openclaw/openclaw394 CVEs ImageMagick/ImageMagick339 CVEs moodle/moodle258 CVEs vim/vim222 CVEs chakra-core/ChakraCore205 CVEs apache/airflow200 CVEs gpac/gpac194 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in wordpress-plugins/plugins.

How many CVEs have a located fix in wordpress-plugins/plugins?: 851 published CVEs have a fix traced to functions in wordpress-plugins/plugins, touching 9,046 functions across 6,107 files.
Which function in wordpress-plugins/plugins has been patched by the most CVEs?: number in media-library-assistant/trunk/includes/class-mla-core.php has been changed by 5 CVE fixes, from 2025 to 2026.
How large is a typical CVE fix in wordpress-plugins/plugins?: The median fix changes 86 lines. 25% of fixes change 20 lines or fewer, and 5% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track wordpress-plugins/plugins CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing