Easy Updates Manager
Easy Updates Manager has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Improper Authorization.
Every one of the 2 issues recorded for Easy Updates Manager has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by Dmitrii Ignatyev. Easy Updates Manager is installed on roughly 300,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2026-7660Easy Updates Manager <= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameter
Read the full analysisVulnerability Records

Easy Updates Manager
Author
David Anderson / Team Updraft
Easy Updates Manager is a light yet powerful plugin that allows you to manage all kinds of update- both on your single site install, or in WordPress Multisite. With a huge number of settings for endless configuration, Easy Updates Manager is an obvious choice for anyone wanting to take control of their website updates. Free Features Include Disable all updates with one click Enable automatic updates with one click Deeply customize your automatic update settings Use logs to determine what and when something is updated Hide plugin and theme updates (if custom developed) Select which plugins and themes can be automatically updated Disable core, plugin, theme, and translation updates Force Updates to check that automatic updates are working Integrate with UpdraftPlus Configure email notification settings And much more… Go Premium Visit easyupdatesmanager.com to upgrade to our premium features. Premium features include: Safe mode: ensures updates are compatible with your WordPress version and your server’s PHP version Schedule for automatic updates: runs the updates when you want them to avoid any downtime External logging – Get alerts when new updates have been logged Anonymization – Control what is sent to the WordPress API Delayed updates – Delay automatic updates in the case of hotfixes and frequent releases Auto backups: integrates with UpdraftPlus and take a backup before your site is updated UpdraftCentral: fully integrates with UpdraftCentral Log clearing schedule: keeps your logs table under control and deletes entries according to your own schedule Import/Export settings: exports your settings from one site to another for quick configuration Email notification of updates: gives you weekly or monthly reports of pending updates White label: disables notices and customizes what the client sees Check plugins: runs a check of plugins that have been removed from the WordPress Plugin Directory Webhook: integrates with third-party services to run automatic updates via cron or even Zapier Export logs: exports logs for printing, or downloads a CSV or JSON file for a date range Version control protection: prevent updates from occurring to plugins and themes under version control For more information on Easy Updates Manager Premium, check out our website at easyupdatesmanager.com. Translations If you want to contribute to the translation, please visit our translation section. We appreciate all the translation help we can get.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C