How to find outdated WordPress plugins with known vulnerabilities
Short answer: list every plugin with its installed and latest version (Dashboard → Updates, or wp plugin list --update=available), look each one up in a public vulnerability database such as Wordfence Intelligence, WPScan or Patchstack, update or remove anything vulnerable, and delete plugins that are closed or no longer maintained.
Quick steps
- List plugins and versions. Use Dashboard → Updates or WP-CLI to see installed and available versions.
- Look up known vulnerabilities. Search each plugin in a public WordPress vulnerability database.
- Update or remove. Update vulnerable plugins; remove ones without a fix or that you don’t use.
- Find abandoned plugins. Check each plugin’s page on WordPress.org for closure notices and last update date.
- Turn on auto-updates. Enable automatic updates for plugins you trust, and keep backups.
1. List plugins and versions
In the admin, Dashboard → Updates lists everything with an update. With shell access, WP-CLI is faster:
wp plugin list --fields=name,status,version,update_version
wp plugin list --update=available
wp theme list --update=available
wp core check-update2. Look up known vulnerabilities
Search each plugin slug in a public database. Each entry shows the affected versions and the version that fixes it:
3. Update, or remove
- Take a backup first, then update. Test the checkout, forms and login afterwards.
- If there is no fixed version, deactivate and delete the plugin and find an alternative.
- Deactivated plugins are still files on your server. Delete what you don’t use.
wp plugin update --all --dry-run
wp plugin update contact-form-7
wp plugin delete hello-dolly4. Find closed or abandoned plugins
Open each plugin’s page on WordPress.org. A closed plugin shows a notice and gets no more fixes. A plugin that hasn’t been updated in years, or hasn’t been tested with recent WordPress versions, is a risk even without a published vulnerability.
5. Check files weren’t changed
wp core verify-checksums
wp plugin verify-checksums --allChanged core or plugin files can mean the site was already compromised. See how to tell if your WordPress site is hacked.
6. Turn on auto-updates
Since WordPress 5.5 you can enable automatic updates per plugin from the Plugins screen. Turn them on for well-maintained plugins and keep daily backups so you can roll back.
What a remote scan can see
HackGrade’s free scan finds plugins, themes and the core version that your public pages reveal (for example through file paths and version strings) and matches them against public vulnerability data. Plugins that leave no trace in the public pages can’t be seen from outside, so the WP-CLI list above is the complete one.
Frequently asked questions
Is it safe to update all plugins at once?
It’s usually fine, but take a backup first and test key pages afterwards. On a busy store, update one plugin at a time.
Does deactivating a vulnerable plugin protect me?
Partly. Some vulnerable files can still be reached directly. Delete plugins you don’t use.
How do I know if a vulnerability is actually being exploited?
Databases such as Wordfence Intelligence and Patchstack note active exploitation, and CISA lists exploited CVEs in its KEV catalog. Treat those as urgent.