Co-Authors Plus
Co-Authors Plus has one disclosed vulnerability in the WordSec catalog, all reported in 2022; it is fixed as of September 2026. Their average CVSS score is 7.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (100%).
The one issue recorded for Co-Authors Plus has a vendor fix available, so running the current release closes it.
All of these findings were reported by Douglas Johnson. Co-Authors Plus is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
Co-Authors Plus 3.5 - 3.5.1 - Sensitive Information Disclosure
Read the full analysisVulnerability Records

Co-Authors Plus
Author
Automattic
Assign multiple bylines to posts, pages, and custom post types via a search-as-you-type input box. Co-authored posts appear on a co-author’s archive page and in their feed. Co-authors may edit the posts they are associated with, and co-authors who are contributors may only edit posts if they have not been published (as is core behavior). Add writers as bylines without creating WordPress user accounts. Simply create a guest author profile for the writer and assign the byline as you normally would. On the frontend, use the Co-Authors Plus template tags or the block editor blocks to list co-authors anywhere you’d normally list the author. Documentation Usage — themer and site-owner guides live on the GitHub Wiki: template tags, blocks, guest author management, and multisite. Developer reference — lives in-repo under docs/ (not bundled in the distribution ZIP): Filters and actions REST API Upgrading to 4.0 Co-Authors Plus is an almost complete rewrite of the Co-Authors plugin originally developed by Weston Ruter (2007). The original plugin was inspired by the ‘Multiple Authors‘ plugin by Mark Jaquith (2005).
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C