Friends

Friends has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 3 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 2 disclosures.

The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (33%). Other recurring categories include Missing Authorization, Server-Side Request Forgery (SSRF).

Every one of the 3 issues recorded for Friends has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. Friends is installed on roughly 900 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Friends vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2025-7504

Friends 3.5.1 - Authenticated (Subscriber+) PHP Object Injection

Read the full analysis

Vulnerability Records

3 records
Friends banner
Latestv4.3.1
5.0(7)
100/100
Last Updated
2026-09-04 (8d ago)
Active Installs
900+
Downloads
93,655
Requires WP
0+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2018-05-06 (9y ago)

The Friends plugin turns your WordPress into a self-hosted social reader. Follow people via RSS and ActivityPub (Mastodon and other Fediverse platforms) and read their posts through one of several built-in themes — Mastodon-style, Google Reader-style, or the default view — with dark mode support. Combine this plugin with the ActivityPub plugin to participate in the Fediverse from your own site. Use the Enable Mastodon Apps plugin to use mobile and desktop Mastodon apps with your WordPress. The plugin is designed to be extensible: other plugins can add parsers for new feed sources, new themes, and new functionality like saving posts to a collection or sending them to an eReader. You can… – Choose from multiple themes: Mastodon-style, Google Reader-style, and a block theme with dark mode. – Organize your subscriptions into folders. – Have multiple feeds per person (blog, social media, etc.). – Categorize incoming content with Post Formats and view all posts of a certain format across your feeds. – Define rules to filter incoming content. – Get full-post email notifications from your favorite blogs. – Save posts to a collection for later reference (via the Post Collection plugin). – Send posts to your eReader (via the Send to E-Reader plugin). – Subscribe to any site with one click using the Friends browser extension (also available for Firefox). Philosophy The Friends Plugin was built to make use of what WordPress provides: You use the WordPress infrastructure (Gutenberg or Classic Editor, what you prefer) to create your posts. Followed people are stored as taxonomy terms, their posts are cached as a custom post type — delete the term to unfollow. No extra tables: The Friends plugin just uses a post type, options, and some taxonomies to store its data. When you delete the plugin, your WordPress will be as slim as before. The logo was created by Ramon Dodd, @ramonopoly. Thank you! Documentation for the plugin can be found on the GitHub project Wiki. Development of this plugin is done on GitHub. Pull requests welcome. Please see issues reported there before going to the plugin forum.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C