Plugin Organizer

Plugin Organizer has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 6.5 out of 10.

The most common weakness is SQL Injection, behind 2 of the records (100%).

Every one of the 2 issues recorded for Plugin Organizer has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Plugin Organizer is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Plugin Organizer vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2026-15304

Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection

Read the full analysis

Vulnerability Records

2 records


2026-07-27 20:32	Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection Plugin Organizer <= 10.2.4	`CVE-2026-15304`	6.5 Medium	zhuxuan wu	Yes
2025-12-08 00:00	Plugin Organizer <= 10.2.3 - Authenticated (Subscriber+) SQL Injection Plugin Organizer <= 10.2.3	`CVE-2025-13417`	6.5 Medium	Alex Tselevich (nos3curity)	Yes

Showing 1–2 of 2 reports

Latestv10.2.6

Plugin Organizer

Author

Jeff Sterup

4.7(227)

94/100

Last Updated

2026-08-23 (21d ago)

Active Installs

10,000+

Downloads

794,090

Requires WP

6.0+

Requires PHP

Tested up to

WP 7.1

Created

2010-12-22 (16y ago)

This plugin allows you to do the following: 1. Change the order that your plugins are loaded. 2. Selectively disable plugins by any post type or wordpress managed URL. 3. Adds grouping to the plugin admin age. WARNING: Reordering or disabling plugins can have catastrophic affects on your site. It can cause issues with plugins and can render your site inaccessible.

View on WordPress.org