Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?PrivateContentWP Private Content PlusPrivateContent - Mail Actions
Plugin · wp-private-content-plus
WP Private Content Plus
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Aug 11, 2025WP Private Content Plus: Sensitive Information ExposureCVE-2025-4390 · affects up to 3.6.2 · reported by WordfenceMedium 5.3
The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and feed pages.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2024WP Private Content Plus: Sensitive Information ExposureCVE-2024-11292 · affects up to 3.6.1 · reported by WordfenceMedium 5.3
The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Feb 28, 2024WP Private Content Plus: Information disclosureCVE-2024-0680 · affects up to 3.6 · reported by WordfenceMedium 5.3
The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.
Jul 1, 2023WP Private Content Plus: Cross-Site Request ForgeryCVE-2021-4385 · affects up to 3.1 · reported by WordfenceMedium 4.3
The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on the save_groups() function. This makes it possible for unauthenticated attackers to add new group members via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Aug 30, 2019The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.CVE-2019-15816 · fixed in 2.0 · reported by MITREHigh 7.5
The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.