Zotpress

Zotpress has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2016 and 2026; 8 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.8, and the most serious one scores 9.9 out of 10. Severity breakdown: 2 critical and 0 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (67%). Other recurring categories include SQL Injection, Improper Access Control.

8 of the records (89%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

8 independent researchers contributed these findings, most of them (2) reported by LVT-tholv2k. Zotpress is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage89%
Open

1

Fixed

8

Get automatic notifications for all Zotpress vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2026-27420

Zotpress <= 7.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

9 records
Zotpress banner
Latestv7.4.4

Zotpress

Katie

Author

Katie

4.9(66)
98/100
Last Updated
2026-08-08 (3mo ago)
Active Installs
2,000+
Downloads
140,901
Requires WP
3.6+
Requires PHP
0+
Tested up to
WP 7.0.7
Created
2011-02-05 (16y ago)

Zotpress brings publication broadcasting and scholarly blogging to WordPress through Zotero, a free, cross-platform reference manager. Features Displays your personal and group Zotero items through in-text citations, bibliographies, and searchable libraries Supports thumbnail images through WordPress’s Media Library and Open Library Supports selective CSS styling via IDs and classes Provides a range of additional features, such as allowing visitors to download citations And more! Compatible with Firefox, Safari, Chrome, and IE9. Made with jQuery, jQuery UI, jQuery doTimeout, Live Query, OAuth, and Open Library. Special thanks to Joe Alberts for substantial contributions to the code, comprehensive testing, and design ideation. Thanks also to contributors Jeremy Varnham (@jvarn13), Christopher Cheung, Jason S., Chris Wentzloff, Karljürgen Feuerherm (@feuerherm), Mark Dingemanse (@codeispoetry), Jörg Mechnich (jmechnich@github), Tomas Risberg, @ericcorbett2, @timtom, @alhrath, and André Lambelet for their code contributions, testing, and guidance. Finally, my sincere gratitude goes out to all who have donated in support of this plugin. Please note that this plugin is on semi-hiatus, with updates expected about 1-3 times a year. Requirements jQuery included in your theme (Zotpress will do this for you if it isn’t already included), and an HTTP request method supported by WordPress enabled on your server: cURL, fopen with Streams (PHP 5), or fsockopen. In your server config file, X-Frame-Options should be set to SAMEORIGIN. Optional: OAuth enabled on your server.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C