JS Archive List

JS Archive List has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 7.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 4 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Deserialization Of Untrusted Data, behind 2 of the records (50%). Other recurring categories include SQL Injection.

Every one of the 4 issues recorded for JS Archive List has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. JS Archive List is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSHigh
7.5/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all JS Archive List vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2026-32513

JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection

Read the full analysis

Vulnerability Records

4 records
JS Archive List banner
Latestv6.3.1

JS Archive List

Miguel Useche

Author

Miguel Useche

4.8(45)
96/100
Last Updated
2026-04-03 (5mo ago)
Active Installs
3,000+
Downloads
124,852
Requires WP
4.7+
Requires PHP
7.4+
Tested up to
WP 6.9.7
Created
2009-12-27 (17y ago)

This plugin provides a widget and a filter to display a collapsible archive list in your sidebar or posts using the JS JS library. Features Support for Gutenberg blocks. Add it to any FSE theme or Gutenberg compatible theme. Display a collapsed list of your archives to reduce space. Uses vanilla JS to add effects and to be compatible with all browsers. Select your expand/collapse symbol and date format. Support for archive filters. Auto expands current/select year from posts. Select the categories to exclude Multiple instances support. Shortcode support [JsArchiveList] Generates valid HTML code. Supports multiple languages. Compatible with most JS cache and minify plugins. And more to come… Configuration Title: title of the widget. Trigger Symbol: characters to be displayed as bullet. Effect: Effect to use. Month Format: month’s display format of the month. Expand: when to expand the content of the list. Hide years from before: older years will be hidden under a link. To save space in the page on old sites. Show days inside month list: group posts by day. Show number of posts: display how many post are published in the year or in the month. Show only posts from selected category: show only posts from the selected category when visiting a category page. Only expand/reduce by clicking the symbol: select if animations start when click the link or just the bullet. Open links in a new tab: opens archive and post links in a new browser tab/window. Only expand one at the same time: select if you want to have only one expanded at the same time. Show posts under months: show post’s title under months. Show post date next to post title: show post’s date next to post title. Sort posts by: select how to sort the posts under months. Include or Exclude categories: Select the categories to include or exclude.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C