Insert Special Characters

Insert Special Characters has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2022; all 9 are fixed as of September 2026. Their average CVSS score is 7.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 4 high. 2022 was the busiest year with 8 disclosures.

The most common weakness is Improperly Controlled Modification Of Dynamically-Determined Object Attributes, behind 3 of the records (33%). Other recurring categories include Inefficient Regular Expression Complexity, Uncontrolled Resource Consumption.

Every one of the 9 issues recorded for Insert Special Characters has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Sam Wheating. Insert Special Characters is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
7.0/ 10
Patch Coverage100%
Open

0

Fixed

9

Get automatic notifications for all Insert Special Characters vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2022-25912

simple-git < 3.15.0 - Remote Code Execution

Read the full analysis

Vulnerability Records

9 records
Insert Special Characters banner
Latestv1.1.3

Insert Special Characters

10up

Author

10up

4.9(8)
98/100
Last Updated
2026-09-01 (11d ago)
Active Installs
3,000+
Downloads
82,815
Requires WP
6.5+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2019-08-30 (7y ago)

Ever wanted to add a special character while working within the WordPress block editor (Gutenberg) and suddenly find yourself longing for the days of the Classic Editor and the Special Character inserter? Well long no more, the Insert Special Characters plugin is here to ease your publishing woes! Note: you can display the popover via the ctrl/cmd + o keyboard shortcut. Development takes place in the GitHub repository. Technical Notes Requires PHP 7.4+. Requires WordPress 6.6+ Issues and Pull requests welcome in the GitHub repository. Extending To control the available tabs and characters, developers can filter the data set using the insertspecialcharacters-characters JavaScript (wp.hooks) filter. For example, to create a character inserter that only provides currency symbols: wp.hooks.addFilter( 'insertspecialcharacters-characters', // The filter name. 'mycallback', // Our callback namespace. function( component ) { // The callback function. // Return the categories/characters to display. // The data structure is: { category: [ character data ], category2: ... } return { "Currency": [ { "entity": "&dollar;", "hex": "&#0024;", "name": "Dollar Sign", "char": "$" }, { "entity": "&euro;", "hex": "&#20AC;", "name": "Euro Sign", "char": "€" }, { "entity": "&cent;", "hex": "&#00A2;", "name": "Cent Sign", "char": "¢" }, { "entity": "&pound;", "hex": "&#00A3;", "name": "Pound Sign", "char": "£" }, { "entity": "&yen;", "hex": "&#00A5;", "name": "Yen Sign", "char": "¥" }, ] }; } );

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C