Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?WPCodeinsert-headers-and-footers-script
Plugin · insert-headers-and-footers
WPCode
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 14, 2026WPCode: Does not correctly verify that a request is genuinely for the login screen before entering its snippet safe modeCVE-2026-101301 · fixed in 2.4.0 · reported by WPScanMedium 5.3
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.
May 27, 2026WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager: Remote Code ExecutionCVE-2026-8832 · affects up to 2.3.5 · reported by WordfenceHigh 8.8
The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.3.5 This is due to the 'wpcode' custom post type being registered without a custom capability_type or capability restrictions in the wpcode_register_post_type() function, allowing WordPress core to fall back to standard post capabilities for all creation paths including XML-RPC. This makes it possible for authenticated attackers, with author-level access and above, to create and publish executable PHP snippet posts via XML-RPC wp.newPost, which are then executed server-side via eval() in the run_eval() function when the snippet is rendered through the [wpcode] shortcode.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 7, 2023WPCode: Does not escape generated URLs before outputting them in attributesCVE-2023-3524 · fixed in 2.0.13.1 · reported by WPScanMedium 6.1
The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
Apr 24, 2023WPCode: Has a flawed CSRFCVE-2023-1624 · fixed in 2.0.9 · reported by WPScanMedium 6.5
The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders
Mar 6, 2023WPCode: Does not have adequate privilege checks in place for several AJAX actionsCVE-2023-0328 · fixed in 2.0.7 · reported by WPScanMedium 4.3
The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication (such as update and delete the auth key).
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.