WP Emmet

WP Emmet has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

None of the 2 issues recorded for WP Emmet have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, one record each. WP Emmet is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.1.42.

Strategic Overview

Avg CVSSMedium

4.4/ 10

Patch Coverage0%

Open

Fixed

Get automatic notifications for all WP Emmet vulnerabilities before they are exploited.

Most severe open issueCVSS 4.4CVE-2025-15658

Emmet <= 0.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records


2025-08-16 00:00	Emmet <= 0.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting WP Emmet <= 0.3.4	`CVE-2025-15658`	4.4 Medium	Que Thanh Tuan	No
2025-08-16 00:00	WP Emmet <= 0.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting WP Emmet <= 0.3.4	`CVE-2025-49894`	4.4 Medium	Que Thanh Tuan - Blue Rock	No

Showing 1–2 of 2 reports

Plugin Profile

Latestv0.3.4

WP Emmet

Author

rewish

5.0(10)

100/100

Last Updated

2015-02-24 (12y ago)

Active Installs

3,000+

Downloads

21,788

Requires WP

4.0+

Requires PHP

Tested up to

WP 4.1.42

Created

2013-01-28 (14y ago)

Do you want to use the Emmet in admin page? This plugin will support it! Fork me on GitHub 🙂

View on WordPress.org