Is Hide My WP Ghost safe?

Every recorded flaw

• Oct 16, 2026WP Ghost (Hide My WP Ghost) – Security & Firewall: Stored Cross-Site ScriptingCVE-2026-89051 · affects up to 7.0.12 · reported by WordfenceHigh 7.2
• Sep 19, 2026WP Ghost (Hide My WP Ghost) – Security & Firewall: Open RedirectCVE-2026-7527 · affects up to 7.0.02 · reported by WordfenceMedium 4.7
• Sep 18, 2026Hide My WP Ghost: Does not properly validate a loopback security-check request before disabling its login and URL hiding protectionCVE-2026-86800 · fixed in 7.0.11 · reported by WPScanMedium 5.3
• Sep 18, 2026Hide My WP Ghost: Does not verify that a request is a genuine WooCommerce request before disabling its firewallCVE-2026-86796 · fixed in 7.0.11 · reported by WPScanMedium 5.3
• Sep 8, 2026Hide My WP Ghost: Server-Side Request Forgery (SSRF)CVE-2026-81806 · affects up to 7.0.09 · reported by PatchstackHigh 7.2
• Jul 30, 2026WP Ghost (Hide My WP Ghost): Does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headersCVE-2026-11870 · fixed in 7.0.05 · reported by WPScanMedium 5.4
• Jul 27, 2026Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.CVE-2026-59546 · affects up to 7.0.06 · reported by PatchstackHigh 7.4
• Apr 8, 2026Hide My WP Ghost: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-39484 · reported by PatchstackMedium 4.7
• Mar 27, 2025Hide My WP Ghost: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26909 · affects up to 5.4.01 · reported by PatchstackCritical 9.6
• Mar 14, 2025WP Ghost (Hide My WP Ghost) – Security & Firewall: Path TraversalCVE-2025-2056 · affects up to 5.4.01 · reported by WordfenceHigh 7.5
• Feb 12, 2025WP Ghost (Hide My WP Ghost) – Security & Firewall: Login Page DislcosureCVE-2024-13794 · affects up to 5.3.02 · reported by WordfenceMedium 5.3
• Nov 15, 2024Hide My WP Ghost – Security & Firewall: Reflected Cross-Site ScriptingCVE-2024-10825 · affects up to 5.3.01 · reported by WordfenceMedium 6.1
• Jul 23, 2024Hide My WP Ghost: Does not prevent redirects to the login page via the auth_redirect WordPress functionCVE-2024-6420 · fixed in 5.2.02 · reported by WPScan1.8% oddsHigh 8.6
• Jun 4, 2024Hide My WP Ghost: Improper Restriction of Excessive Authentication AttemptsCVE-2023-34001 · affects up to 5.0.25 · reported by PatchstackMedium 5.3
• May 8, 2023Hide My WP Ghost – Security: IP Address SpoofingCVE-2022-4537 · affects up to 5.0.18 · reported by WordfenceMedium 6.5
• Feb 6, 2023Hide My WP: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4681 · fixed in 6.2.9 · reported by WPScan3.8% oddsCritical 9.8
• Nov 24, 2021WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user.CVE-2021-36917 · affects up to 6.2.3 · reported by Patchstack2.0% oddsMedium 6.5
• Nov 24, 2021The SQL injection vulnerability in the Hide My WP WordPress plugin (versions <= 6.2.3) is possible because of how the IP address is retrieved and used inside a CVE-2021-36916 · affects up to 6.2.3 · reported by Patchstack1.9% oddsHigh 8.6

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.