Security Scorecard Grades For WordPress Plugins Redirecting Vulnerability Reports to the Patchstack Vulnerability Disclosure Program (VDP)

  1. Progress Planner     A
  2. YITH WooCommerce Quick View     B+
  3. YITH WooCommerce Wishlist     B+
  4. Embed Privacy     B
  5. Maintenance     B
  6. Simply Static     B
  7. Stock Ticker     B
  8. User Registration & Membership     B
  9. User Switching     B
  10. Converter for Media     B
  11. WP Crontrol     B
  12. Equalize Digital Accessibility Checker     C+
  13. Automatic Translate Addon For Loco Translate     C+
  14. Breeze     C+
  15. Cozy Blocks     C+
  16. Document Library Lite     C+
  17. ElementsKit Lite     C+
  18. 301 Redirects     C+
  19. FluentCRM     C+
  20. Force Regenerate Thumbnails     C+
  21. HT Mega     C+
  22. MetForm     C+
  23. Omnisend for WooCommerce     C+
  24. Premium Addons for Elementor     C+
  25. Product Variations Swatches for WooCommerce     C+
  26. Query Monitor     C+
  27. reSmush.it Image Optimizer     C+
  28. Restrict User Access     C+
  29. LazyLoad Plugin     C+
  30. ShortPixel Image Optimizer     C+
  31. Simple Cloudflare Turnstile     C+
  32. SpeedyCache     C+
  33. The Post Grid     C+
  34. Under Construction     C+
  35. WP Redis     C+
  36. WP Reset     C+
  37. WP Activity Log     C+
  38. YITH WooCommerce Ajax Search     C+
  39. All-in-One WP Migration and Backup     C
  40. Barcode Scanner (+Mobile App)     C
  41. Blocksy Companion     C
  42. Design for Contact Form 7 Style WordPress Plugin     C
  43. Code Snippets     C
  44. Maspik     C
  45. Enable Media Replace     C
  46. Essential Addons for Elementor     C
  47. Event Tickets and Registration     C
  48. EWWW Image Optimizer     C
  49. Gravity PDF     C
  50. InstaWP Connect     C
  51. Mailster WordPress Newsletter Plugin     C
  52. MasterStudy LMS WordPress Plugin     C
  53. Patreon WordPress     C
  54. PowerPack Lite for Elementor     C
  55. Percentage Coupon per Product for WooCommerce     C
  56. ShopEngine     C
  57. The Events Calendar     C
  58. WP 2FA     C
  59. WP Accessibility Helper (WAH)     C
  60. WP Fusion Lite     C
  61. WP Go Maps (formerly WP Google Maps)     C
  62. WS Form LITE     C
  63. YITH WooCommerce Product Gallery & Image Zoom     C
  64. Advanced Google reCAPTCHA     D+
  65. Ajax Search Lite     D+
  66. Better Notifications for WP     D+
  67. Contact List     D+
  68. Content Control     D+
  69. Contextual Related Posts     D+
  70. FluentSMTP     D+
  71. GiveWP     D+
  72. Imagify Image Optimization     D+
  73. Masteriyo LMS     D+
  74. LiteSpeed Cache     D+
  75. Login Lockdown     D+
  76. Pods     D+
  77. The Plus Addons for Elementor     D+
  78. Top 10     D+
  79. Ultra Addons for Contact Form 7     D+
  80. Unlimited Elements for Elementor     D+
  81. Increase Maximum Upload File Size     D+
  82. HUSKY     D+
  83. WordPress Native PHP Sessions     D+
  84. myCred     D
  85. Patchstack     D
  86. Stop User Enumeration     D
  87. Pixel Manager for WooCommerce     D
  88. Hustle     D
  89. Ad Inserter     F
  90. Activity Log     F
  91. BEAF - Ultimate Before After Image Slider & Gallery     F
  92. Defender     F
  93. Download Monitor     F
  94. Elementor     F
  95. Forminator Forms     F
  96. Image Optimizer     F
  97. Kadence Blocks     F
  98. Ally     F
  99. Post SMTP     F
  100. Royal Elementor Addons and Templates     F
  101. Security Ninja     F
  102. Seriously Simple Podcasting     F
  103. TablePress     F
  104. uListing     F
  105. Smush Image Optimization     F
  106. WP User Manager     F

Latest Grade From June 7, 2025

About the Scorecard

The Plugin Security Scorecard grades plugins' handling of security based on data coming from the Plugin Vulnerabilities service, checking over the contents of the plugin, the WordPress.org API, and data generated specifically for the tool. It provides a useful, but incomplete, understanding of the security posture of the plugin and its developer. All the issues identified are ones that the developer of the plugin has the ability to address to get the grade of the plugin up to an A+.

Grades are calculated based on issues with any of the following:

  • Plugins known to be vulnerable
  • Plugin developers with track records of improperly handling security problems
  • Security issues in the plugin that can be detected in an automated fashion
  • Issues with the developer's developerment processes that suggest that their could be problems with security
  • Plugins making unsupported, misleading, and false claims about their handling of security and the handling of security with WordPress

We are working to expand and refine the tools' ability to provide a good measure of plugins' security status. If you are aware of an additional security concern with this plugin that isn't represented here, please contact us. Other feedback on the tool is also welcome.

If you want a comprehensive understanding of the security of the plugin, a well-done security review is really needed to provide that.






Check Plugin Not in WordPress Plugin Directory

Subscribers of our service can submit ZIP files of plugins that are not in the WordPress Plugin Directory to have them checked. (Not all issues can be checked for with uploaded plugins, as they require data not available with just the plugin's files.) You can sign up for the service for free here. For existing subscribers, once you are logged in to your account, return to this page to access that functionality.

The results of these gradings will not be stored.