RootsPersona

RootsPersona has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 2 are fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for RootsPersona has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by domiee13. RootsPersona is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all RootsPersona vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2025-39368

Rootspersona <= 3.7.5 - Missing Authorization

Read the full analysis

Vulnerability Records

2 records
RootsPersona banner
Latestv4.3.0

RootsPersona

urryes

Author

urryes

4.6(17)
92/100
Last Updated
2026-10-22 (6d ago)
Active Installs
400+
Downloads
36,411
Requires WP
6.0+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2011-01-19 (16y ago)

RootsPersona turns the GEDCOM file of your genealogy program into a family history website. Every person gets a real WordPress page with their name in the title — found by Google, linked from your posts, open for comments, editable in your page builder. When the tree changes, upload the new file: pages, addresses and photos stay with their people. Everything is free. No account, no external service, your data stays on your site. From your genealogy program GEDCOM 5.5, 5.5.1 and 7.0 / 7.1 from any program, also as a GEDZIP archive (.gdz) or a .zip with the photos. Any encoding: UTF-8, UTF-16, ANSEL, Windows code pages (Cyrillic “ANSI” files are recognised). Tags of common programs: married names (_MARN, _MARNM), adoption (_FREL, _MREL), other names (_AKA), the main photo (_PRIM), the person codes (_UID, FamilySearch ids). Large trees are imported in small steps with a progress bar, so the host’s time limit does not stop them. A report after the import tells what was loaded. Re-importing updates the tree. People renumbered by your program are recognised by their code, by name and birth year or by their relatives. If the file looks like another tree, the import stops before anything is changed. Export back to GEDCOM 5.5.1, GEDCOM 7.0 or GEDZIP with the photos: a backup, or a copy for relatives and other programs, with or without living people. The persona page Names (birth, married, also known as, nickname), events and facts with dates, places, addresses, age and cause, notes, sources with the cited page and quoted text. Parents, spouses, children, divorce, adoption and fostering, and a three-generation tree. Dates in the site language: “15 March 1822”, “about 1890”, “between 1852 and 1854”. Julian (Old Style) dates show the New Style too: “15 (27) March 1822”. Any number of photos: the portrait and a gallery with a lightbox. The photos your program links to people go onto their pages by themselves (see the FAQ). A map of the places of the person’s life (OpenStreetMap), when the GEDCOM file has coordinates. Three layouts — Classic, Archive card and Chronicle — with colour sets and a live preview. A page can be printed in parts, so your own text, memoirs or audio can sit between them, in the block editor or in Elementor. schema.org markup (Person) for search engines. For visitors A front page for the tree: the tree in numbers, faces of the older generations, remembrance days around today, ways into the tree, births per decade, families by surname, places on a map. Instant search over people (all their names, places and years) and the posts of the site. An index of people and a top surnames widget. Privacy Each person is Public, Members only or Private; the default for living people is a setting. A person without dates is judged by their own events and by their relatives. Hidden people get “Private” as their page title, a noindex tag, and are left out of sitemaps, menus, search, the front page and the export. Visitors can be sent to a page you choose. Editing on the site If RootsPersona is your “system of record”, people and their facts can be edited online and new people added, without a genealogy program.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C