Cloudflare
Cloudflare has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2016 and 2024; all 2 are fixed as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 7.1 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.
Every one of the 2 issues recorded for Cloudflare has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by Sachin Wagh. Cloudflare is installed on roughly 200,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
Cloudflare < 1.3.21 - Cross-Site Scripting
Read the full analysisVulnerability Records

Cloudflare
Author
Cloudflare
What this plugin can do for you [https://www.youtube.com/watch?v=DWANhxoDxFI] Automatic Platform Optimization (APO) Speed up your WordPress site by up to 300% with Cloudflare’s Automatic Platform Optimization (APO) plugin. APO allows Cloudflare to serve your entire WordPress site from our edge network of over 250+ data centers worldwide ensuring fast & reliable performance for your visitors no matter where they are. Optimizing your WordPress site with multiple plugins can be overwhelming. Take your WordPress site’s performance to the next level by switching to a single plugin for CDN, intelligent caching, and other key WordPress optimizations with Cloudflare (APO). Visit our announcement blog to learn more about APO. What makes APO different from other caching plugins? The key differentiating factor between Cloudflare APO and other traditional page caching and CDN solutions is its ability to directly cache static HTML at Cloudflare’s edge. Every other plugin and CDN will cache your static assets (images, javascript, CSS), but none help you cache the actual content on your site (the HTML) using a massive edge network like Cloudflare’s. APO intelligently caches your HTML pages and will automatically purge content from the cache that you update, so users will always see the latest content without compromising the performance of pages that haven’t been recently updated What you get with Cloudflare APO APO is a $5 add-on with Cloudflare’s free plan and comes with an unlimited amount of subdomains. With APO you also get to leverage many of the other benefits of Cloudflare such as Free DNS, Free Automated SSL Certificates, Free DDoS Mitigation, and more. APO is free for all paid plan users so if you have Cloudflare Pro or Business already you can just turn it on. You can compare all our plans here. Protect your WordPress site with Cloudflare’s Web Application Firewall (WAF) Cloudflare’s WAF is available on all our paid plans and comes with built-in rulesets, specifically tailored to mitigate WordPress threats and vulnerabilities. These security rules are regularly updated by our team of experts. At the flip of a switch, you’ll have your WAF up and running without any difficult adjustments to your site. With over 26 million internet properties under our protection, you can sleep easy knowing Cloudflare has your back. Additional features Header rewrite to prevent a redirect loop when Cloudflare’s Universal SSL is enabled Change Cloudflare settings from within the plugin itself without needing to navigate to the cloudflare.com dashboard. You can change settings for cache purge, security level, Always Online, and image optimization View analytics such as total visitors, bandwidth saved, and threats blocked Support for HTTP2/Server Push
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C