Plugin Notes Plus

Plugin Notes Plus has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.4 out of 10. 2024 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for Plugin Notes Plus has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Plugin Notes Plus is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Plugin Notes Plus vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.4CVE-2024-37561

Plugin Notes Plus <= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Plugin Notes Plus banner
Latestv1.2.10

Plugin Notes Plus

jamiebergen

Author

jamiebergen

5.0(62)
100/100
Last Updated
2026-07-23 (2mo ago)
Active Installs
9,000+
Downloads
77,385
Requires WP
6.2+
Requires PHP
5.6+
Tested up to
WP 7.0.4
Created
2018-02-13 (9y ago)

Have you ever returned to a site that you built a while back and asked, “Why did I install this plugin?” This plugin provides an extra column on the Plugins page that enables you to add, edit, or delete notes about the plugins you have installed on a particular site. These notes are intended to provide documentation regarding why a particular plugin was installed and how or where it’s being used. Features Add as many or as few notes as you need for each plugin. Edit or delete notes as desired. Select an icon to go with each note to quickly convey what type of content it contains (e.g., info, warning, link, etc.) Format notes using basic HTML tags if desired. Any links included in the note will be automatically converted to target="_blank" Notes are added and updated via Ajax, avoiding slow page reloads. Notes also display on the WordPress Updates page for any plugins that need to be updated. A filter is provided if you would like to display notes beneath the plugin description instead of in a separate column. A filter is available to selectively hide or display plugin notes in the admin.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C