SyntaxHighlighter Evolved

SyntaxHighlighter Evolved has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2025; all 3 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Scripting, behind 3 of the records (100%).

Every one of the 3 issues recorded for SyntaxHighlighter Evolved has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. SyntaxHighlighter Evolved is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.

Strategic Overview

Avg CVSSMedium

6.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all SyntaxHighlighter Evolved vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2

SyntaxHighlighter Evolved < 3.5.1 - Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records


2025-03-27 00:00	SyntaxHighlighter Evolved <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting SyntaxHighlighter Evolved <= 3.7.1	`CVE-2025-30903`	6.4 Medium	Peter Thaleikis	Yes
2019-10-21 00:00	SyntaxHighlighter Evolved < 3.5.1 - Stored Cross-Site Scripting SyntaxHighlighter Evolved < 3.5.1	`N/A`	7.2 High	Matt Barry	Yes
2014-08-01 00:00	SyntaxHighlighter Evolved <= 3.1.9 - Cross-Site Scripting SyntaxHighlighter Evolved <= 3.1.9	`N/A`	6.1 Medium	Ben Bidner	Yes

Showing 1–3 of 3 reports

Latestv3.7.2

SyntaxHighlighter Evolved

Author

Alex Mills

4.3(86)

86/100

Last Updated

2025-03-03 (2y ago)

Active Installs

20,000+

Downloads

1,142,724

Requires WP

5.7+

Requires PHP

7.0+

Tested up to

WP 6.7.7

Created

2007-09-10 (19y ago)

Now with support for the new block editor in WordPress 5.0! SyntaxHighlighter Evolved allows you to easily post syntax-highlighted code to your site without losing its formatting or making any manual changes. It uses the SyntaxHighlighter JavaScript package by Alex Gorbatchev. For a live demo, see this plugin’s homepage. For a list of supported languages (most widely used languages are supported), see the WordPress.com support document. Development of this plugin is on GitHub. Translation of the plugin into different languages is on the translation page. As seen on WordPress.com.

View on WordPress.org