Enhanced Plugin Admin

Enhanced Plugin Admin has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2023; all 2 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 6.1 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

Every one of the 2 issues recorded for Enhanced Plugin Admin has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Yuki Haruma. Enhanced Plugin Admin is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

5.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Enhanced Plugin Admin vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.1

Enhanced Admin Plugin < 1.16 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records


2023-03-21 00:00	Enhanced Plugin Admin <= 1.16 - Cross-Site Request Forgery via epa_options_page Enhanced Plugin Admin <= 1.16	`CVE-2023-28618`	5.4 Medium	Yuki Haruma	Yes
2017-04-14 00:00	Enhanced Admin Plugin < 1.16 - Reflected Cross-Site Scripting Enhanced Plugin Admin < 1.16	`N/A`	6.1 Medium	Anonymous	Yes

Showing 1–2 of 2 reports

Latestv1.17

Enhanced Plugin Admin

Author

Marios Alexandrou

5.0(8)

100/100

Last Updated

2026-08-20 (24d ago)

Active Installs

100+

Downloads

5,950

Requires WP

5.0+

Requires PHP

Tested up to

WP 7.1

Created

2015-11-10 (11y ago)

The Enhanced Plugin Admin plugin aims to save you time and warn you about potential compatibility and security problems for installed plugins right from the plugin admin screen. Information includes: last update date overall rating number of votes WordPress version compatibility range WordPress plugin repository status i.e. in repository, removed from repository, never in repository You can also hide (disable) individual plugin update notifications for when you don’t want to upgrade. These can be unhidden (re-enabled) at any time. Planned Features These are features I’ve been considering. Let me know if they’re of interest or if you have other ideas. Schedule checks so that information is up to date without having to wait for plugin admin page to refresh. Email notifications when thresholds are first exceeded or when vulnerability discovered. Keep track of when a plugin was originally and most recently activated / deactivated.

View on WordPress.org