Outdated WordPress plugins are the leading cause of WordPress compromises. When a vulnerability is discovered in a plugin, it gets publicly documented — and every site still running the old version becomes a target.
Why it's dangerous
When a plugin vulnerability is disclosed, three things happen simultaneously:
- The developer releases a patch
- The vulnerability is published in public databases
- Attackers begin scanning for sites running the vulnerable version
The window between disclosure and exploitation can be hours. Sites that update promptly are safe. Sites that don't are exposed.
How to check from the WordPress dashboard
Go to Dashboard → Updates. WordPress lists any plugins with available updates. Any plugin showing a pending security fix should be treated as a priority.
For more detail, go to Plugins → Installed Plugins. Outdated plugins show a notice below their name.
Beyond the dashboard
The WordPress dashboard shows whether a newer version exists — not whether the current version has a known vulnerability. For that, cross-reference against a vulnerability database.
WPScan's vulnerability database (wpscan.com/plugins) tracks known issues by plugin and version. If your plugin version appears there, update immediately.
High-risk plugins to prioritise
Plugins with large install bases are disproportionately targeted — a vulnerability in them affects millions of sites at once. Page builders, SEO tools, contact form plugins, and e-commerce extensions are frequently in scope.
threatprobe.app's Basic report detects which plugins your site is running and cross-references them against known vulnerability data. Full adds an aggressive audit including exposed user accounts.