Is List category posts safe?

Every recorded flaw

• Jul 16, 2026List category posts: Sensitive Information ExposureCVE-2026-12434 · affects up to 0.95.0 · reported by WordfenceMedium 4.3
• Apr 9, 2026List category posts: Stored Cross-Site ScriptingCVE-2026-3005 · affects up to 0.94.0 · reported by WordfenceMedium 6.4
• Mar 13, 2026List category posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32419 · affects up to 0.93.1 · reported by PatchstackMedium 5.9
• Dec 10, 2025List category posts: Time-based SQL InjectionCVE-2025-10163 · affects up to 0.91.0 · reported by WordfenceMedium 6.5
• Nov 1, 2025List category posts: Information ExposureCVE-2025-11377 · affects up to 0.92.0 · reported by WordfenceMedium 4.3
• May 7, 2025List category posts: Path Traversal: '.../...//'CVE-2025-47636 · affects up to 0.91.0 · reported by PatchstackHigh 7.5
• Jan 18, 2025List category posts: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-9020 · fixed in 0.90.3 · reported by WPScanMedium 5.4
• Mar 30, 2024List category posts: Stored Cross-Site ScriptingCVE-2024-1051 · affects up to 0.89.6 · reported by WordfenceMedium 6.4
• Jan 11, 2024List category posts: Stored Cross-Site ScriptingCVE-2023-6994 · affects up to 0.89.3 · reported by WordfenceMedium 6.4

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.