WP Compiler
WP Compiler has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for WP Compiler has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nabil Irawan. WP Compiler is installed on roughly 900 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.0.27.
CVE-2025-58032WP Compiler <= 1.0.0 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
WP Compiler
Author
Bytes.co
Harness the power of pre-processed CSS and minified JS in your theme or plugin, without any complicated installs or build tools. Simply tell WP Compiler where to find your source files and where to put the compiled results, then throw your install into Dev Mode. WP Compiler watches your source folders for you, and recompiles your CSS and JS on any file change. WP Compiler supports both SCSS and LESS precompilers for CSS, to suit anyone’s preference. When you’re ready to launch a new site, just turn off Dev Mode, and your styles and javascript will be compiled & minimized and comments & source maps will be removed. With Dev mode disabled, Compiler will stop watching source directories, so there is no effect on site performance, but you can still apply a quick change at any time, by clicking the compile button in the admin toolbar. WP Compiler relies on scssphp, lessphp, and minify. Specific issues with the underlying compilation libraries should be submitted to their respective developers.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C