Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · solace-extra
Solace Extra
10 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 30, 2026Solace Extra: Does not perform any authorization or post-status checks on its front-end preview routesCVE-2026-80333 · fixed in 1.7.2 · reported by WPScanMedium 5.3
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve.
Sep 2, 2026Solace Extra: Does not perform any authorization or post-status checks in one of its AJAX actionsCVE-2026-16966 · fixed in 1.7.0 · reported by WPScanMedium 5.3
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.
Aug 16, 2026Solace Extra: Unauthorized modification and loss of dataCVE-2026-18316 · affects up to 1.6.0 · reported by WordfenceCritical 9.1
The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() function in versions up to, and including, 1.6.0. The handler is registered on both wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip and only verifies the 'ajax-nonce' nonce, which is emitted on every admin page via wp_localize_script (unrestricted admin_enqueue_scripts hook) and is therefore accessible to any authenticated user including Subscribers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to wipe navigation menus, sidebar widgets (via update_option('sidebars_widgets', array())), all theme mods (via remove_theme_mods()), and Elementor templates, as well as trigger arbitrary demo-content imports.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.CVE-2026-27535 · affects up to 1.6.0 · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.
Aug 9, 2026Solace Extra: Does not perform capability or nonce checks in one of its AJAX actionsCVE-2026-16965 · fixed in 1.6.1 · reported by WPScanMedium 4.3
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.
Aug 8, 2026Solace Extra: Does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged usersCVE-2026-16948 · fixed in 1.6.1 · reported by WPScanHigh 8.1
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.
Jul 11, 2026Solace Extra: Authorization bypassCVE-2026-13250 · affects up to 1.5.3 · reported by WordfenceMedium 5.3
The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete all content previously imported via the Starter Template feature, including posts, pages, media attachments, WooCommerce products, taxonomy terms, and sitebuilder templates. The required nonce is emitted on every wp-admin page via wp_localize_script() hooked to admin_enqueue_scripts without a page guard, meaning any Subscriber visiting /wp-admin/profile.php can obtain it; the handler is additionally registered via wp_ajax_nopriv_, making it reachable by fully unauthenticated users as well.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 27, 2025Solace Extra: Server-Side Request Forgery (SSRF)CVE-2025-58203 · affects up to 1.3.2 · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through <= 1.3.2.
May 7, 2025Solace Extra: Server-Side Request Forgery (SSRF)CVE-2025-47464 · affects up to 1.3.1 · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through <= 1.3.1.
Apr 17, 2025Solace Extra: Unrestricted Upload of File with Dangerous TypeCVE-2025-32652 · affects up to 1.3.1 · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in solacewp Solace Extra solace-extra allows Using Malicious Files.This issue affects Solace Extra: from n/a through <= 1.3.1.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.