VR-Frases
VR-Frases has 4 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 4 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 6.1 out of 10. 2025 was the busiest year with 4 disclosures.
The most common weakness is Cross-Site Scripting, behind 3 of the records (75%). Other recurring categories include SQL Injection.
Every one of the 4 issues recorded for VR-Frases has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, most of them (2) reported by johska. VR-Frases is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-22636VR-Frases <= 4.0.1 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

VR-Frases
Author
Vicente Ruiz Gálvez
VR-Frases is a comprehensive quote management plugin that allows you to organize, categorize, and display collections of famous quotes and phrases. Perfect for websites that want to share inspirational content, literary quotes, or wisdom from notable figures. Key Features: Quote Management: Add, edit, and organize quotes with full CRUD functionality Author Profiles: Manage author information including biographical data and Wikipedia links Classification System: Organize quotes using classes (categories) and themes (tags) Search & Filter: Advanced search functionality by author, class, or theme Import/Export: Bulk import quotes from CSV/TXT files and export your collection Display Options: Multiple ways to display quotes on your site Responsive Design: Mobile-friendly interface and displays Display Methods: Random Quote: Show a random quote anywhere using [randomfrase] shortcode Quote Collection: Display all quotes with search functionality using [vrfrases] shortcode Widget: Add random quotes to sidebars and widget areas Admin Features: Intuitive dashboard for managing quotes, authors, classes, and themes Quick edit functionality for fast updates Bulk operations for efficient management Import wizard for adding multiple quotes at once Export functionality to backup or share your quote collection Author management with biographical information and Wikipedia integration For Developers: Clean, well-documented code following WordPress standards Template functions for custom implementations Hooks and filters for extensibility Database optimization with proper indexing The plugin creates dedicated database tables to efficiently store quotes, authors, classes, and themes, ensuring optimal performance even with large collections.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C