Is WP OAuth Server (OAuth Authentication) safe?

Every recorded flaw

• Sep 30, 2026Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.CVE-2026-97288 · affects up to 4.5.1 · reported by PatchstackMedium 6.5
• Apr 10, 2024OAuth Server: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-31253 · affects up to 4.3.3 · reported by PatchstackMedium 4.7
• Mar 20, 2023WP OAuth Server (OAuth Authentication): Has a flawed CSRF and authorisation checkCVE-2022-4148 · fixed in 4.3.0 · reported by WPScanMedium 4.3
• Mar 20, 2023WP OAuth Server (OAuth Authentication): Does not have CSRF checkCVE-2022-3894 · fixed in 4.2.5 · reported by WPScanMedium 4.3
• Dec 5, 2022WP OAuth Server (OAuth Authentication): Does not have CSRF checkCVE-2022-3926 · fixed in 3.4.2 · reported by WPScanMedium 6.5
• Dec 5, 2022WP OAuth Server (OAuth Authentication): Does not sanitize and escape Client IDsCVE-2022-3892 · fixed in 4.2.2 · reported by WPScanMedium 4.8
• Sep 25, 2019The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.CVE-2015-9435 · fixed in 3.1.5 · reported by MITRE2.1% oddsCritical 9.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.