ElasticPress

ElasticPress has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2024; all 9 are fixed as of September 2026. Their average CVSS score is 5.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 2 high. 2022 was the busiest year with 6 disclosures.

The most common weakness is Uncontrolled Resource Consumption, behind 3 of the records (33%). Other recurring categories include Cross-Site Request Forgery (CSRF), Code Injection.

Every one of the 9 issues recorded for ElasticPress has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. ElasticPress is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.6/ 10
Patch Coverage100%
Open

0

Fixed

9

Get automatic notifications for all ElasticPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2022-25912

simple-git < 3.15.0 - Remote Code Execution

Read the full analysis

Vulnerability Records

9 records
ElasticPress banner
Latestv5.3.5

ElasticPress

10up

Author

10up

4.2(30)
84/100
Last Updated
2026-09-10 (2d ago)
Active Installs
8,000+
Downloads
1,130,879
Requires WP
6.2+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2014-10-20 (12y ago)

ElasticPress, a fast and flexible search and query engine for WordPress, enables WordPress to find or “query” relevant content extremely fast through a variety of highly customizable features. WordPress out-of-the-box struggles to analyze content relevancy and can be very slow. ElasticPress supercharges your WordPress website making for happier users and administrators. The plugin even contains features for popular plugins. Here is a list of the amazing ElasticPress features included in the plugin: Search: Instantly find the content you’re looking for. The first time. Instant Results: A built for WordPress search experience that bypasses WordPress for optimal performance. Instant Results routes search queries through a dedicated API, separate from WordPress, returning results up to 10x faster than previous versions of ElasticPress. WooCommerce: With ElasticPress, filtering WooCommerce product results is fast and easy. Your customers can find and buy exactly what they’re looking for, even if you have a large or complex product catalog. Related Posts: ElasticPress understands data in real time, so it can instantly deliver engaging and precise related content with no impact on site performance. Protected Content: Optionally index all of your content, including private and unpublished content, to speed up searches and queries in places like the administrative dashboard. Documents: Indexes text inside of popular file types, and adds those files types to search results. Autosuggest: Suggest relevant content as text is entered into the search field. Filters: Add controls to your website to filter content by one or more taxonomies. Comments: Indexes your comments and provides a widget with type-ahead search functionality. It works with WooCommerce product reviews out-of-the-box.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C