Plugin Notes Plus
Plugin Notes Plus has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.4 out of 10. 2024 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.
Every one of the 2 issues recorded for Plugin Notes Plus has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Plugin Notes Plus is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2024-37561Plugin Notes Plus <= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Plugin Notes Plus
Author
jamiebergen
Have you ever returned to a site that you built a while back and asked, “Why did I install this plugin?” This plugin provides an extra column on the Plugins page that enables you to add, edit, or delete notes about the plugins you have installed on a particular site. These notes are intended to provide documentation regarding why a particular plugin was installed and how or where it’s being used. Features Add as many or as few notes as you need for each plugin. Edit or delete notes as desired. Select an icon to go with each note to quickly convey what type of content it contains (e.g., info, warning, link, etc.) Format notes using basic HTML tags if desired. Any links included in the note will be automatically converted to target="_blank" Notes are added and updated via Ajax, avoiding slow page reloads. Notes also display on the WordPress Updates page for any plugins that need to be updated. A filter is provided if you would like to display notes beneath the plugin description instead of in a separate column. A filter is available to selectively hide or display plugin notes in the admin.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C