MainWP
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| MainWP Child Reports | 3 | – | Apr 8, 2026 |
| MainWP Child | 2 | – | Oct 8, 2026 |
| MainWP Dashboard: Self-hosted WordPress Management for Agencies | 2 | – | Mar 13, 2024 |
| MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites | 2 | – | Dec 13, 2024 |
| MainWP Code Snippets Extension | 2 | – | May 17, 2024 |
| MainWP Links Manager Extension | 1 | – | Mar 28, 2024 |
| MainWP Maintenance Extension | 1 | – | Jul 18, 2023 |
| MainWP Matomo Extension | 1 | – | Feb 23, 2023 |
| MainWP Staging Extension | 1 | – | Jun 9, 2024 |
| MainWP UpdraftPlus Extension | 1 | – | Jun 9, 2024 |
| MainWP | 1 | – | Jun 29, 2026 |
| MainWP Wordfence Extension | 1 | – | Mar 25, 2024 |
| MainWP Broken Links Checker Extension | 1 | – | Oct 12, 2023 |
| MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance | 1 | – | Dec 20, 2023 |
| MainWP File Uploader Extension | 1 | – | Mar 26, 2024 |
| MainWP Google Analytics Extension | 1 | – | Oct 12, 2023 |
Exploited and recent CVEs
- CVE-2026-105436 WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability 0.2%
- CVE-2026-57327 WordPress MainWP plugin <= 6.1.1 - Broken Access Control vulnerability 0.3%
- CVE-2026-27366 WordPress MainWP Child plugin <= 6.1.1 - Broken Access Control vulnerability 0.3%
- CVE-2026-4299 MainWP Child Reports <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via Heartbeat API 0.6%
- CVE-2024-10783 MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation 2.3%
- CVE-2024-7492 MainWP Child Reports <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update 0.3%
- CVE-2023-23640 WordPress MainWP UpdraftPlus Extension Plugin <= 4.0.6 - Subscriber+ Arbitrary Plugin Activation Vulnerability 0.3%
- CVE-2023-23639 WordPress MainWP Staging Extension Plugin <= 4.0.3 - Subscriber+ Arbitrary Plugin Activation Vulnerability 0.3%
- CVE-2023-23645 WordPress MainWP Code Snippets Extension Plugin <= 4.0.2 - Subscriber+ Arbitrary PHP Code Injection/Execution Vulnerability 1.0%
- CVE-2024-33680 WordPress MainWP Child Reports plugin <= 2.1.1 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
- CVE-2023-23649 WordPress MainWP Links Manager Extension Plugin <= 2.1 - Unauthenticated PHP Object Injection Vulnerability 0.8%
- CVE-2023-23656 WordPress MainWP File Uploader Extension Plugin <= 4.1 - Unauthenticated Arbitrary File Upload Vulnerability 0.8%
- CVE-2023-22699 WordPress MainWP Wordfence Extension Plugin <= 4.0.7 - Subscriber+ Arbitrary Plugin Activation Vulnerability 0.3%
- CVE-2024-1642 MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulk 0.3%
- CVE-2023-38519 WordPress MainWP Plugin <= 4.4.3.3 is vulnerable to SQL Injection 0.6%
- CVE-2023-6164 MainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS Injection 0.4%
- CVE-2023-23737 WordPress MainWP Broken Links Checker Extension Plugin <= 4.0 is vulnerable to SQL Injection 0.7%
- CVE-2023-23651 WordPress MainWP Google Analytics Extension Plugin <= 4.0.4 - SQL Injection vulnerability 0.7%
- CVE-2023-23660 WordPress MainWP Maintenance Extension Plugin <= 4.1.1 is vulnerable to SQL Injection 0.8%
- CVE-2023-3132 MainWP Child <= 4.4.1.1 - Information Disclosure via Back-Up Files 0.7%
- CVE-2023-23650 WordPress MainWP Code Snippets Extension Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS) 0.4%
- CVE-2023-23659 WordPress MainWP Matomo Extension Plugin <= 4.0.4 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%