Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?mainwp-childMainWP Child Reports
Plugin · mainwp-child
mainwp-child
6 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 8, 2026MainWP Child: Deserialization of Untrusted DataCVE-2026-105436 · affects up to 6.2.1 · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
Jul 27, 2026MainWP Child: Does not verify the requester's identity in its site-registration request handlerCVE-2026-12255 · fixed in 6.1.2 · reported by WPScanHigh 8.1
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
Jun 25, 2026Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.CVE-2026-27366 · affects up to 6.1.1 · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.
Dec 13, 2024MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites: Privilege escalationCVE-2024-10783 · affects up to 5.2 · reported by WordfenceHigh 8.1
The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note versions up to 5.3.3 contained a patch, though a bypass was discovered and not addressed until version 5.3.4.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 26, 2023MainWP Child: Sensitive Information ExposureCVE-2023-3132 · affects up to 4.4.1.1 · reported by WordfenceMedium 5.9
The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion of the back-up files fail.
Nov 23, 2021MainWP Child: Does not validate the orderby and order parameter before using them in a SQL statementCVE-2021-24877 · fixed in 4.1.8 · reported by WPScanHigh 7.2
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.