Is Stream safe?

Every recorded flaw

• Aug 7, 2026Stream: Authorization bypassCVE-2026-11907 · affects up to 4.2.0 · reported by WordfenceMedium 6.5
• Feb 17, 2025Stream: Server-Side Request ForgeryCVE-2024-13879 · affects up to 4.0.2 · reported by WordfenceMedium 5.5
• Sep 13, 2024Stream: Cross-Site Request ForgeryCVE-2024-7423 · affects up to 4.0.1 · reported by WordfenceHigh 8.8
• Dec 19, 2023Stream: Authorization Bypass Through User-Controlled KeyCVE-2022-43450 · affects up to 3.9.2 · reported by PatchstackMedium 4.3
• May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in XWP Stream plugin <= 3.9.2 versions.CVE-2022-43490 · affects up to 3.9.2 · reported by PatchstackMedium 5.4
• Feb 6, 2023Stream: Does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionalityCVE-2022-4384 · fixed in 3.9.2 · reported by WPScanMedium 6.5
• Nov 17, 2021Stream: Does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statementCVE-2021-24772 · fixed in 3.8.2 · reported by WPScan1.6% oddsHigh 8.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.