Insert Special Characters
Insert Special Characters has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2022; all 9 are fixed as of September 2026. Their average CVSS score is 7.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 4 high. 2022 was the busiest year with 8 disclosures.
The most common weakness is Improperly Controlled Modification Of Dynamically-Determined Object Attributes, behind 3 of the records (33%). Other recurring categories include Inefficient Regular Expression Complexity, Uncontrolled Resource Consumption.
Every one of the 9 issues recorded for Insert Special Characters has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by Sam Wheating. Insert Special Characters is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2022-25912simple-git < 3.15.0 - Remote Code Execution
Read the full analysisVulnerability Records

Insert Special Characters
Author
10up
Ever wanted to add a special character while working within the WordPress block editor (Gutenberg) and suddenly find yourself longing for the days of the Classic Editor and the Special Character inserter? Well long no more, the Insert Special Characters plugin is here to ease your publishing woes! Note: you can display the popover via the ctrl/cmd + o keyboard shortcut. Development takes place in the GitHub repository. Technical Notes Requires PHP 7.4+. Requires WordPress 6.6+ Issues and Pull requests welcome in the GitHub repository. Extending To control the available tabs and characters, developers can filter the data set using the insertspecialcharacters-characters JavaScript (wp.hooks) filter. For example, to create a character inserter that only provides currency symbols: wp.hooks.addFilter( 'insertspecialcharacters-characters', // The filter name. 'mycallback', // Our callback namespace. function( component ) { // The callback function. // Return the categories/characters to display. // The data structure is: { category: [ character data ], category2: ... } return { "Currency": [ { "entity": "$", "hex": "", "name": "Dollar Sign", "char": "$" }, { "entity": "€", "hex": "AC;", "name": "Euro Sign", "char": "€" }, { "entity": "¢", "hex": "�A2;", "name": "Cent Sign", "char": "¢" }, { "entity": "£", "hex": "�A3;", "name": "Pound Sign", "char": "£" }, { "entity": "¥", "hex": "�A5;", "name": "Yen Sign", "char": "¥" }, ] }; } );
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C