wp-Monalisa
wp-Monalisa has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2024; all 2 are fixed as of September 2026. Their average CVSS score is 4.9, and the most serious one scores 5.5 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.
Every one of the 2 issues recorded for wp-Monalisa has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by SOPROBRO. wp-Monalisa is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
wp-Monalisa <= 6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

wp-Monalisa
Author
tuxlog
wp-monalisa is the plugin that smiles at you like monalisa does. place the smilies of your choice in posts, pages or comments. There are a lot plugins for smiley support out there and some of them are really useful. Most of them don’t work out of the box and this is what wp-monalisa tries to achieve, giving you the ability to maintain your smilies and even turn them into img tags. it’s easy and it smiles at you…what else do you want? Features: maintain your smilies in a separate directory activate or deactivate smilies for posts or comments replace smilies with img tags extend or replace wordpress smiley replacement while edit posts or pages, pops-up in a draggable meta-box extends your comment form to give you visitors the freedom to smile 🙂 support for fckeditor (tested with v3.3.1) fully integrated with BuddyPress, bbPress and wpForo The video shows a short overview of what wp-monalisa can do for you. Credits: Thanks go to all who support this plugin, with hints and suggestions for improvment and specially to Michal Maciejewski, polish translation Denny from http://www.vau3.de for testing and giving input for the BuddyPress integration FJ Bakry, Camisto (https://camisto.com) for indonesian translation
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C