Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Really Simple SSLReally Simple Security Pro
Plugin · really-simple-ssl
Really Simple SSL
13 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 18, 2026Really Simple Security: Does not validate a client-supplied address value before using itCVE-2026-88798 · fixed in 9.8.3 · reported by WPScanMedium 5.3
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
Sep 14, 2026Really Simple Security: Missing authorization checkCVE-2026-82519 · fixed in 9.8.2 · reported by VulnCheckLow 2.3
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.
Sep 13, 2026Really Simple Security: Does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolmentCVE-2026-89080 · fixed in 9.8.1 · reported by WPScanHigh 7.5
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
Sep 3, 2026Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.CVE-2026-84777 · affects up to 9.8.0 · reported by PatchstackHigh 7.4
Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.
Sep 2, 2026Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.CVE-2026-84775 · affects up to 9.8.0 · reported by PatchstackMedium 5.3
Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.
Aug 30, 2026Really Simple Security: Does not check that the user is allowed to install Really Simple Security WordPress plugin before 9CVE-2026-81766 · fixed in 9.8.0 · reported by WPScanMedium 6.6
The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute arbitrary code in the network-shared Really Simple Security WordPress plugin before 9.8.0 directory, which WordPress otherwise reserves to the network administrator. Exploitation requires the network administrator to have enabled the Really Simple Security WordPress plugin before 9.8.0 administration menu for subsites, which is not the default.
Jun 15, 2026Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions.CVE-2026-48970 · affects up to 9.5.10 · reported by PatchstackHigh 8.1
Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions.
Jun 15, 2026Subscriber Broken Access Control in Really Simple SSL <= 9.5.9 versions.CVE-2026-48969 · affects up to 9.5.9 · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Really Simple SSL <= 9.5.9 versions.
Jun 2, 2026Really Simple Security: Does not enforce the second-factor challenge in two of its two-factor authentication REST endpointsCVE-2026-8293 · fixed in 9.5.10.1 · reported by WPScanHigh 7.5
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.
Mar 13, 2026Really Simple SSL: Missing AuthorizationCVE-2026-32461 · affects up to 9.5.7 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple SSL: from n/a through <= 9.5.7.
Jan 24, 2025Really Simple SSL: Cross-Site Request Forgery (CSRF)CVE-2025-24623 · affects up to 9.1.4 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Cross Site Request Forgery.This issue affects Really Simple SSL: from n/a through <= 9.1.4.
Nov 14, 2024The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1.CVE-2024-10924 · affects 9.0.0 to 9.1.1.1 · reported by WordfenceCritical 9.8
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 18, 2024Really Simple SSL: Server-Side Request Forgery (SSRF)CVE-2024-31229 · affects up to 7.2.3 · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in Really Simple Plugins Really Simple SSL.This issue affects Really Simple SSL: from n/a through 7.2.3.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.