Dropdown Multisite Selector

Dropdown Multisite Selector has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 2 are fixed as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

Every one of the 2 issues recorded for Dropdown Multisite Selector has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Dropdown Multisite Selector is installed on roughly 900 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Dropdown Multisite Selector vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-31090

Dropdown Multisite selector < 0.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Plugin Profile
Latestv1.0.0

Dropdown Multisite Selector

alordiel

Author

alordiel

5.0(19)
100/100
Last Updated
2026-09-12 (2mo ago)
Active Installs
900+
Downloads
33,611
Requires WP
6.0+
Requires PHP
8.3+
Tested up to
WP 7.1.3
Created
2014-01-14 (13y ago)

This plugin lets you build a fully configurable dropdown field whose options act as links: when a visitor picks one, they are redirected to the matching URL. It was originally built for multisite networks to make navigation between subsites faster, but it now supports custom links as dropdown options too. Ways to populate the dropdown Manual list – define each option yourself: enter a name and the URL the visitor is redirected to when they choose it. All network sites – automatically list every site in your WordPress Multisite Network as an option. The user’s sites only – list only the network sites where the current logged-in user is registered. What you can customize Label – set a label for the dropdown, or leave it empty for no label. Placeholder – the first, non-clickable option (for example “Select branch”, “Select country”, “Choose side”). Sorting – order your manual list alphabetically, or reverse it so your most recent entries appear first. Behaviour – send the visitor to the selected URL, or treat the URLs as images and load the chosen one into the [dms_target] container on the same page, without leaving it. Once your settings are saved, display the dropdown with the [dms] shortcode or the bundled widget. Shortcodes [dms] – Renders the dropdown exactly as configured on the admin settings page. [dms_manual name=”” placeholder=”” target=”” options=””] – Renders a standalone dropdown that is independent of your saved settings. Accepts these attributes: name – the dropdown label (leave empty for no label). placeholder – the first option shown in the menu (for example “– Select –“). target – “default” to open links in the same tab, or “blank” to open them in a new tab. options – comma-separated URL/name pairs in the form “url1|name1, url2|name2, url3|name3”. The order within each pair is detected automatically, so “name|url” works too. Option names cannot contain a comma or a vertical bar, as both are used to separate the values. Example: [dms_manual name="Label" placeholder="--Select--" target="blank" options="https://duckduckgo.com|Trusted search engine, https://google.bg|Tracking search engine"] [dms_target] – Marks the spot where the selected image is loaded. Place it anywhere on the same page as [dms] and set the behaviour to “Open in target section” on the settings page: choosing an option then swaps the image in this container instead of redirecting the visitor. If the behaviour is set to images but this shortcode is missing from the page, the dropdown shows a warning. Developers can also replace the container markup through the dms_target_filter filter. Need extra functionality? Open an issue on GitHub or ask in the support forum, and I’ll see whether it can be added. Thanks to everyone who has shared ideas for improving this plugin. Filters Here are the filters you can use to modify the plugin’s output: dms_sites_arguments – control the attributes passed to get_sites() when the “Show all sites in the WordPress Multisite Network” option is selected. dms_multisite_pairs – filter the results returned from get_sites(). dms_users_sites – control the sites when the “Show only the sites where the user is registered” option is selected. dms_target_filter – replace the markup returned by the [dms_target] shortcode.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C