WordPress plugin · wp-nested-pages
Is Nested Pages safe?
Safe on 3.3.3 or newer.
The current version, 3.3.3, is past every affected range on record (11 of 11 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 11
- High or critical
- 3
- Exploited
- none
- Current version
- 3.3.3
- Last updated
- Sep 25, 2026
- Active installs
- 90,000+
Every recorded flaw
- Sep 30, 2026Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.CVE-2026-100512 · affects up to 3.3.2 · reported by PatchstackCritical 9.8
- Aug 4, 2026Nested Pages: Does not properly escape post titles before outputting them into HTML attributes on an administrative listing screenCVE-2026-15233 · fixed in 3.2.15 · reported by WPScanMedium 4.8
- May 15, 2025Nested Pages: Does not sanitise and escape some of its settingsCVE-2024-8759 · fixed in 3.2.9 · reported by WPScanMedium 4.8
- Mar 23, 2025Nested Pages: Does not sanitise and escape some of its settingsCVE-2025-0718 · fixed in 3.2.13 · reported by WPScanMedium 4.8
- Jan 24, 2025Nested Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24579 · affects up to 3.2.9 · reported by PatchstackMedium 5.9
- Jul 4, 2024Nested Pages: Cross-Site Request ForgeryCVE-2024-5943 · affects up to 3.2.7 · reported by WordfenceHigh 8.8
- Dec 14, 2023Nested Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49195 · affects up to 3.2.6 · reported by PatchstackMedium 5.9
- May 31, 2023Nested Pages: Unauthorized loss of dataCVE-2023-2434 · affects up to 3.2.3 · reported by WordfenceLow 3.8
- Jun 27, 2022Nested Pages: Does not escape and sanitize the some of its settingsCVE-2022-1990 · fixed in 3.1.21 · reported by WPScanMedium 4.8
- Aug 30, 2021The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSorCVE-2021-38343 · affects up to 3.1.15 · reported by WordfenceMedium 4.7
- Aug 30, 2021The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which alCVE-2021-38342 · affects up to 3.1.15 · reported by WordfenceHigh 8.1
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.