Solace Extra

Solace Extra has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 10 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 9.1 out of 10. Severity breakdown: 1 critical and 2 high. 2026 was the busiest year with 6 disclosures.

The most common weakness is Missing Authorization, behind 5 of the records (50%). Other recurring categories include Server-Side Request Forgery (SSRF), Unrestricted Upload Of File With Dangerous Type.

Every one of the 10 issues recorded for Solace Extra has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, most of them (3) reported by JunHee CHO. Solace Extra is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Solace Extra vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.1CVE-2026-18316

Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action

Read the full analysis

Vulnerability Records

10 records


2026-08-31 00:00	Solace Extra < 1.7.0 - Missing Authorization to Unauthenticated Unpublished Site Builder Content Disclosure Solace Extra < 1.7.0	`CVE-2026-16966`	5.3 Medium	JunHee CHO	Yes
2026-08-15 00:00	Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action Solace Extra <= 1.6.0	`CVE-2026-18316`	9.1 Critical	Wordfence PRISM	Yes
2026-08-11 00:00	Solace Extra <= 1.6.0 - Missing Authorization Solace Extra <= 1.6.0	`CVE-2026-27535`	4.3 Medium	Dahmani Toumi (pega_SUS)	Yes
2026-08-03 00:00	Solace Extra <= 1.6.0 - Missing Authorization Solace Extra <= 1.6.0	`CVE-2026-16948`	4.3 Medium	JunHee CHO	Yes
2026-08-03 00:00	Solace Extra <= 1.6.0 - Missing Authorization Solace Extra <= 1.6.0	`CVE-2026-16965`	4.3 Medium	JunHee CHO	Yes
2026-07-10 15:06	Solace Extra <= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX Action Solace Extra <= 1.5.3	`CVE-2026-13250`	5.3 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2025-08-27 00:00	Solace Extra <= 1.3.2 - Authenticated (Admin+) Server-Side Request Forgery Solace Extra <= 1.3.2	`CVE-2025-58203`	6.4 Medium	Que Thanh Tuan - Blue Rock	Yes
2025-05-07 00:00	Solace Extra <= 1.3.1 - Authenticated (Subscriber+) Server-Side Request Forgery Solace Extra <= 1.3.1	`CVE-2025-47464`	6.4 Medium	stealthcopter	Yes
2025-04-10 00:00	Solace Extra <= 1.3.1 - Authenticated (Subscriber+) Arbitrary File Upload Solace Extra <= 1.3.1	`CVE-2025-32652`	8.8 High	theviper17y	Yes
2025-03-06 00:00	Solace Extra <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Upload Solace Extra <= 1.3.0	`N/A`	8.8 High	Anonymous	Yes

Showing 1–10 of 10 reports

Latestv1.7.1

Solace Extra

Author

solacewp

0.0(0)

0/100

Last Updated

2026-09-02 (11d ago)

Active Installs

10,000+

Downloads

118,201

Requires WP

6.2+

Requires PHP

7.4+

Tested up to

WP 7.1

Created

2024-05-20 (2y ago)

The Solace Extra plugin is designed to enhance the user experience for Solace Theme users by facilitating the selection and importation of pre-designed Elementor templates. With this plugin, users can effortlessly browse through a variety of templates and seamlessly import them into their WordPress website, simplifying the process of building stunning pages with Elementor. This plugin uses external services provided by SolaceWP and Google reCAPTCHA. These services include fetching demo content, retrieving plugin information, and providing security features to prevent spam and abuse. Data will be sent to and retrieved from https://solacewp.com/api (which is operated by the plugin author) and https://www.google.com/recaptcha. For more details, please refer to the service terms of use and privacy policies: – SolaceWP: Terms of Use, Privacy Policy – Google reCAPTCHA: Terms of Use, Privacy Policy – Sendy API: Terms of Use, Privacy Policy

View on WordPress.org