Create

Create has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 10 are fixed as of October 2026. Their average CVSS score is 6.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2026 was the busiest year with 6 disclosures.

The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 4 of the records (40%). Other recurring categories include SQL Injection, Cross-Site Scripting.

Every one of the 10 issues recorded for Create has a vendor fix available, so running the current release closes all known holes.

8 independent researchers contributed these findings, most of them (2) reported by Krzysztof Zając. Create is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

10

Get automatic notifications for all Create vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-1711

Create by Mediavine <= 1.9.4 - Unauthenticated SQL Injection via 'id'

Read the full analysis

Vulnerability Records

10 records
2026-09-18 19:11CVE-2026-13200
6.5
Medium
Wordfence PRISMYes
2026-09-18 19:11CVE-2026-13191
6.5
Medium
Wordfence PRISMYes
2026-08-03 00:00CVE-2026-16992
5.3
Medium
Pedro PinhoYes
2026-08-03 00:00CVE-2026-18037
5.3
Medium
Erwan LRYes
2026-07-22 00:00CVE-2026-24552
6.5
Medium
Nabil IrawanYes
2026-07-22 00:00CVE-2026-65490
5.3
Medium
Que Thanh TuanYes
2024-08-12 00:00CVE-2024-43264
5.3
Medium
Peng ZhouYes
2024-07-04 00:00CVE-2024-37495
6.4
Medium
LVT-tholv2kYes
2024-06-26 19:03CVE-2024-5601
6.4
Medium
Krzysztof ZającYes
2024-03-19 00:00CVE-2024-1711
9.8
Critical
Krzysztof ZającYes
Showing 1–10 of 10 reports
Create banner
Latestv3.0.0
4.3(25)
86/100
Last Updated
2026-10-23 (4d ago)
Active Installs
6,000+
Downloads
343,657
Requires WP
6.5+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2018-09-26 (8y ago)

Recipes, guides, and lists — for creators who care about their craft. Create gives you everything you need to publish recipes, how-to guides, and lists — with correct Schema.org markup, fast page loads, and an editor that stays out of your way. Whether you’re sharing recipes, DIY tutorials, travel guides, crochet patterns, game walkthroughs, or curated round-ups, Create handles the structured content so you can focus on creating. One plugin. Three card types. Full schema support. Recipes — Granular ingredient editing, nutrition facts (with automatic calculation on Free+ and paid plans), video embeds, and built-in importers for 10+ recipe plugins How-to guides — Step-by-step instructions with materials lists, photos, and video for any kind of tutorial or guide Lists and round-ups — Showcase links, images, and products with drag-and-drop ordering and bulk import (Pro Lists) New Independent Ownership In mid-2025, Create was purchased from Mediavine by John-Michael, one of the plugin’s founding developers. Create is now fully independent and continues to be actively developed at Create Studio. Why Create? Fast by default — Lightweight JavaScript and optimized bundling so your cards don’t slow down your pages SEO built in — Recipe, HowTo, and ItemList JSON-LD generated automatically with one-click schema validation Looks like your site — Seven card themes that inherit your fonts and colors, including Editorial and Modern Elegant Ad-ready themes — Optimized card layouts with configurable ad slot placements Gutenberg and Classic Editor — Full block editor support with live preview, plus shortcode fallback Built-in importers — Switch from WP Recipe Maker, Tasty, EasyRecipe, and 9 other plugins without a separate download Nutrition calculator — Automatic nutrition data powered by API Ninjas, included free with the Free+ plan Modern editor experience — Keyboard shortcuts throughout the app, simple workflows, and unobtrusive customization options designed for how you actually work Plans Create is free to use, with optional plans through Create Studio that unlock more features. Every new site starts on Free, and you can switch plans at any time from Create > Settings. Free — Recipe, How-to, and List cards with full schema, manual nutrition, Recommended Products, the Amazon Creators API integration, the built-in importers, and the five standard card themes. Reviews you’ve already collected keep displaying. Free+ (free, ad-supported) — Everything in Free, plus automatic nutrition calculation, automatic product and list-item scraping, new reader ratings and reviews, Interactive Mode, Adjustable Servings, and Unit Conversion. Interactive Mode is always on for Recipe and How-to cards on Free+: it opens in a new tab on create.studio, which is the only place Create shows its ads. Your site’s own ads and pages are untouched. Pro Guides — Everything in Free+, plus Interactive Mode on your own site with no Create ads, Interactive Checklists, review management (edit, respond to, and feature reviews, plus the Featured Review block), the Editorial and Modern Elegant themes, premium Recommended Products display options, and Custom CSS. Pro Lists — Everything in Free, plus automatic nutrition, scraping, and new reviews; the premium Editorial, Leaderboard, and Ranked list layouts; Bulk List Import; list items that stay in sync with your cards; and Custom CSS. Pro Lists does not include Interactive Mode, Adjustable Servings, or Unit Conversion. Pro Pass — Every Pro Guides and Pro Lists feature, plus 50% off additional sites. Eligible sites can try paid features free for 14 days, and earn up to 7 bonus trial days by completing setup steps. External services Create connects to the following third-party services. No data is sent unless you use the feature that requires it. Create Studio Create Studio powers nutrition calculation, URL scraping, Interactive Mode/Unit Conversion/Servings Adjustment widgets, dashboard tips and broadcasts, and plan and subscription management. Requests are made when you connect your site or use those features, and may include your site URL, connection token, plugin version, card data, ingredient text, scraped URLs, and account email. Connecting from the plugin creates a Create Studio account for the admin’s email if one doesn’t exist. On the Free+ plan, Interactive Mode opens on create.studio, where Create Studio shows ads. Terms of Use — Privacy Policy API Ninjas Nutrition When you calculate nutrition for a recipe, only raw ingredient text is relayed to API Ninjas through Create Studio. Terms of Use — Privacy Policy Amazon Creators API When you add or refresh an Amazon product, Create contacts Amazon using the Associate credentials you enter in settings. Data sent includes the product ASIN or URL and your Associate tag and Creators API credentials. Amazon Associates Program Operating Agreement — Privacy Policy Mediavine video If a card references a Mediavine-hosted video, Create requests that video’s metadata (by slug) for JSON-LD, embeds, and imports. Privacy Policy

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C