WP-CORS

WP-CORS has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

2 independent researchers contributed these findings, one record each. WP-CORS is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.2.11.

Strategic Overview

Avg CVSSMedium

4.3/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all WP-CORS vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2026-25410

WP-CORS <= 0.2.2 - Missing Authorization

Read the full analysis

Vulnerability Records

2 records


2026-01-28 00:00	WP-CORS <= 0.2.2 - Missing Authorization WP-CORS <= 0.2.2	`CVE-2026-25410`	4.3 Medium	Nabil Irawan	No
2023-04-28 00:00	WP-CORS <= 0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting WP-CORS <= 0.2.1	`CVE-2022-47606`	4.4 Medium	Justiice	Yes

Showing 1–2 of 2 reports

Plugin Profile

Latestv0.2.2

WP-CORS

Author

tstephenson

2.3(3)

46/100

Last Updated

2023-07-28 (3y ago)

Active Installs

1,000+

Downloads

40,833

Requires WP

3.6+

Requires PHP

Tested up to

WP 6.2.11

Created

2014-10-05 (12y ago)

My use case is to allow content authors to write help pages in WordPress. This content is fetched and embedded into a single page application hosted on another domain. AJAX requests to this site from another are typically disallowed by the browser’s security model. To permit legitimate uses the requesting browser may include an Origin header containing its domain. This plugin uses the Origin header to decide whether to allow the request or not. Allowed domains can be specified in the plugin’s Settings page.

View on WordPress.org