ID Arrays
ID Arrays has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for ID Arrays has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
All of these findings were reported by Skalucy. ID Arrays is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.7.35.
CVE-2025-68854ID Arrays <= 2.1.2 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

ID Arrays
Author
harman79
This plugin is all about IDs and offers a twofold functionality. a) Adds a custom admin options page with WP List Tables that allow you to get a delimited list of post/page IDs by taxonomy / tag or post type. Listing of IDs by template only works for pages, not posts. This can be particularly useful when for example you are working with WP conditional tags, where it is common practice to create a delimited list of post or taxonomy IDs. If there are many posts or taxonomies required, the process of finding each ID one by one can get a bit annoying and time consuming. This plugin makes it easier for you. It creates delimited lists of post/page IDs based on taxonomy/tag, post type, template or user selection from WP list-tables. b) Adds a column displaying IDs in the posts/pages, media, taxonomies and users screens. It also offers the option to automatically copy the IDs of selected items. For a clearer picture please have a look in the Screenshots section. Features: Works for built in and custom post types and taxonomies. Works fine with Woocommerce and WPML. Provides a settings page to control functionality. An auto-copy to clipboard function is also provided. Note: The “Copy Selected IDs” button added in the WP built-in post/page and taxonomy list edit screens uses Javascript and works for all major browsers (Note: IE 10+). The auto copy to clipboard function is not supported by Safari, but you still get the selected IDs in the textbox, so you can copy them manually.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C