Age Gate
Age Gate has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2025; all 5 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (40%). Other recurring categories include Missing Authorization, Open Redirect.
Every one of the 5 issues recorded for Age Gate has a vendor fix available, so running the current release closes all known holes.
5 independent researchers contributed these findings, one record each. Age Gate is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-2505Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'
Read the full analysisVulnerability Records

Age Gate
Author
Phil
There are many uses for restricting content based on age, be it movie trailers, beer or other adult themes. This plugin allows you to set a restriction on what content can been seen or restricted based on the age of the user. Features Ask users to verify their age on page load SEO Friendly – common bots and crawlers are omitted from age checks Ability to add custom user agents for less common bots Shortcode for in content restrictions Choose to restrict an entire site, or selected content Select a different age on individual content Allow certain content to not be age gated under “all content” mode Three choices for input; dropdowns, input fields or a simple yes/no button Customise the order of the inputs based on your region (DD MM YYYY or MM DD YYYY) Allow a “remember me” check box if desired Ability to omit logged in users from being checked Add your own logo Update the text displayed on the entry form Select background colour/image, foreground colour and text colour Use built in styling out of the box, or your own custom style Ability to add legal note or information to the bottom of the form Redirect failed logins to a URL of your choice e.g. an alcohol awareness website. Ability to use a non caching version Various hooks to add even more customisation such as additional form fields Compatible with multilingual plugins WPML, Polylang (2.3+), WP Multilang
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C