WP-LESS
WP-LESS has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (100%).
The one issue recorded for WP-LESS has a vendor fix available, so running the current release closes it.
All of these findings were reported by Nguyễn Trung Kiên. WP-LESS is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.8.15.
CVE-2025-31550WP-LESS <= 1.9.6 - Unauthenticated Sensitive Information Disclosure
Read the full analysisVulnerability Records
WP-LESS
Author
thom4
LESS is a templating language based on top of CSS. It provides numerous enhancements to speed up development and make its maintenance easier. Theme developers can even bundle the plugin without worrying about conflicts: just include the special bootstrap-for-theme.php and read its instructions. Features Variables Mixins (inheritance of rules) Nested Rules (write less, do more) Accessors (inherit a value from a specific rule) Functions (logic operations for dynamic results) The plugin lets you concentrate on what you need: coding CSS. Everything else is handled automatically, from cache management to user delivery. Seriously. Documentation Advanced topics on how to use the plugin API are available on the Github project documentation. Requirements The sole requirement is to use WordPress API and LESS convention: the .less extension. Minimal Requirements: PHP 5.3 and WordPress 3.2. Relies on: Less.php, plugin-toolkit. Notice: in case you’d like to drop the usage of this plugin, it’s safe to do it. You will just need to convert back your stylesheets to CSS.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C