WordPress plugins that put your site’s security at risk (and how to avoid them)

Plugins are one of WordPress’s great strengths, but also one of its main weak points.
We often install plugins lightly, without checking who built them, whether they are maintained or whether they are compatible with our WordPress version.

Unfortunately, many attacks start precisely from vulnerable or abandoned plugins.

How to recognise a risky plugin

1. It has not been updated for years
   If a plugin has not received updates for a long time (e.g. more than a year), it may contain known vulnerabilities that will never be fixed.
2. It has few active installations
   A low number of installations can mean the plugin is poorly tested or unreliable.
3. Publicly reported vulnerabilities
   You can check on sites such as WPScan whether there are CVEs (Common Vulnerabilities and Exposures) associated with the plugin.
4. It is not in the official WordPress directory
   If a plugin comes from unverified external sources, you risk installing malicious code.
5. It asks for unjustified permissions
   Some plugins access sensitive data or functions on your site even when they do not need to. A classic example? Optimisation plugins that edit the .htaccess file without any control.

Real examples

• RevSlider and WP GDPR Compliance were at the centre of global attacks in past years because of serious flaws.
• Unverified download plugins often contain backdoors that allow arbitrary file uploads.

How to protect yourself

• Install only up-to-date, well-reviewed plugins.
• Uninstall plugins you do not use.
• Use a security system (such as Wordfence) that monitors suspicious changes.
• Check vulnerability reports regularly.
• Take a backup before updating or installing new plugins.

⚠️ Remember: a single vulnerable plugin can compromise the whole site.
Do not install plugins “just to try them out”: every plugin is a door into your site, and it is up to you whether to leave it open.