Hide Plugins
Hide Plugins has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for Hide Plugins has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nabil Irawan. Hide Plugins is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.5.33.
CVE-2025-62115Hide Plugins <= 1.0.4 - Missing Authorization
Read the full analysisVulnerability Records

Hide Plugins
Author
ThemeBoy
Hide Plugins is a light-weight plugin that gives a single admin user the ability to hide plugins prevent them from being activated, deactivated, or deleted by clients and other users, including administrators. By activating Hide Plugins, you will be able to see all plugins and a toggle to hide each plugin from other users on the Plugins page. Hide Plugins will always remain hidden. Note that the dropdown on the Edit Plugins page will not be affected, since it does not have a filter to hook into. Hidden plugins will remain active, so traces of the plugin in areas other than the Plugins page (like options pages in the admin menu) will still be visible. If you also want to hide menus, we recommend using Admin Menu Editor.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C