Login
3 Feb 2025

Plugin Security Scorecard January Results

January was the sixth full month our Plugin Security Scorecard was available. A fair amount of plugins were checked. A total of 148 plugins were checked last month. With 7 of those plugins being security plugins.

As can be seen below, the results for security plugins were not good. With the best grade being a D+. That comes from a combination of different issues. Some of those plugins have security issues. Some come from developers that have had repeated issues with vulnerabilities and are not addressing the underlying problems. Most security plugins are failing to implement best practices for security. Then there is the issue of the plugin developers making security claims that are at least not supported with evidence (and often couldn’t be supported with evidence, since they are not true).

The overall results were better than those for just security plugins, but not great. No plugins got an A+,  A or B+. Those three grades require the developer is taking proactive measures with security, so most plugin developers are not taking measures to provide the best security. 35 of the plugins did get a B, which requires that they are avoiding unnecessary security issues.

January Security Scorecard Grades for  Security Plugins

January Security Scorecard Grades for Other Plugins

Related posts:

  1. Automattic’s WPScan Is Violating the Rules of the CVE Program With Advance Custom Fields “Vulnerability”
  2. Spokesperson for WordPress.org Claims It is Committed to “Continued” Transparency and Increasing Security Expectations
  3. 600,000+ Install WordPress Plugin MetaSlider Still Using Vulnerable Version of Library 17 Months Later
  4. One of the Moderators of Reddit’s WordPress Forum Doesn’t Want People Know About WordPress’ Missing Conflict of Interest Policy

Leave a Reply

Your email address will not be published.