Hello World

Hello World has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 6.5 out of 10.

The most common weakness is Path Traversal, behind 1 of the records (100%).

The one issue recorded for Hello World has a vendor fix available, so running the current release closes it.

All of these findings were reported by Muhammad Yudha - DJ. Hello World is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Hello World vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2024-9224

Hello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read

Read the full analysis

Vulnerability Records

1 records


2024-09-30 00:00	Hello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read Hello World <= 2.1.1	`CVE-2024-9224`	6.5 Medium	Muhammad Yudha - DJ	Yes

Showing 1–1 of 1 reports

Plugin Profile

Latestv2.2.0

Hello World

Author

Bernhard Kau

0.0(0)

0/100

Last Updated

2025-10-26 (11mo ago)

Active Installs

200+

Downloads

17,948

Requires WP

Requires PHP

5.2+

Tested up to

WP 6.9.7

Created

2015-02-18 (12y ago)

In tribute to the famous “Hello Dolly” plugin by Matt Mullenweg comes this new plugin. And how could someone possible name a new default plugin other than “Hello World”, as it’s THE definition for a default example 🙂

View on WordPress.org