As of today’s release, our Plugin Vulnerabilities plugin includes entries for 200 security vulnerabilities that have existed in WordPress plugins. While that is far from all of the vulnerabilities out there, it does include a good mix of vulnerabilities. So far we have focused on adding newly discovered vulnerabilities, vulnerabilities that we are seeing exploit attempts for, and vulnerabilities from the archives of security researchers. We have included some stats we collected on those vulnerabilities below.
One stat stands out, over a quarter of the vulnerabilities – 54 of 200 – have not been fixed. A few of these were only recently discovered or the developer was only recently informed of them (all too often no one bothers to inform the developer and this is something that our work on the plugin has been rectifying), but for the vast majority there has been ample time and notice to the developer so they should have been fixed by now. This is a big problem because simply keeping plugins up to date won’t protect you if the latest version of the plugin has a known security vulnerability that can be exploited.
Right now what happens when a vulnerability isn’t fixed is that the plugin will be removed from the WordPress.org Plugin Directory until it is fixed, assuming the people running the Plugin Directory are informed of the issue. That does nothing for any websites that already have the plugin installed though. It is a problem we have been highlighting for three years now, without getting a solution. It also has been over two years since there was indication that a solution was being worked on. We hope that it won’t take another year to finally get fixed. In the meantime you can use our Plugin Vulnerabilities plugin to get alerted to known vulnerabilities in installed plugins and our No Longer in Directory plugin to find out what installed plugins have been removed from the WordPress.org Plugin Directory.
Plugin Vulnerability Stats As of March 2, 2015
- 200 vulnerabilities included
- 54 included vulnerabilities are in the most recent version of plugins (49 of these plugins have been removed from the Plugin Directory)
- 14 vulnerabilities have been fixed in part due to our work on this plugin
- 5 included vulnerabilities in security plugins
- Top vulnerability types:
- cross-site request forgery (CSRF)/cross-site scripting (XSS): 49 vulnerabilities
- reflected cross-site scripting (XSS): 39 vulnerabilities
- unrestricted file upload: 31 vulnerabilities
- arbitrary file viewing: 16 vulnerabilities
- SQL injection: 15 vulnerabilities
- Top vulnerability discoverers:
- dxwsecurity: 27 vulnerabilities
- Kacper Szurek: 25 vulnerabilities
- High-Tech Bridge: 10 vulnerabilities
- HomeLab IT: 6 vulnerabilities
- Netsparker: 2 vulnerabilities