The vulnerable plugin on your site is probably your page builder
Published October 30, 2026
When a site has a known-vulnerable plugin, I used to picture some abandoned thing installed in 2019 and forgotten. After going through the vulnerability findings across the sites we watch, I have to let that picture go. The vulnerable stuff is the opposite of obscure. It’s the plugins everyone installs on purpose.
37% of the sites had at least one component with a published CVE. Not a theoretical risk — a known hole with a number next to it. And when I sorted by what was actually vulnerable, the same few families came up again and again: page builders and the add-ons people stack on top of them.
The worst offenders were the big names
Here’s a sample of what was running live, with the count of known vulnerabilities each one carries:
| Component | Known vulns | Critical |
|---|---|---|
| Jet Engine (3.7.7) | 30 | 23 |
| Newsletter (6.7.3) | 21 | 4 |
| Simply Schedule Appointments (1.6.12) | 18 | 8 |
| Slider Revolution (6.6.12) | 16 | 3 |
| WPBakery / js_composer (6.10.0) | 16 | 1 |
| Royal Elementor Addons (1.7.1068) | 9 | 1 |
A Jet Engine with thirty known vulnerabilities, twenty-three of them critical, sitting on a live site serving customers. That’s not a corner case I went looking for. It was just there.
It keeps coming back to Elementor
No single plugin showed up on more sites than the Elementor ecosystem. Not just Elementor and Elementor Pro — the whole orbit around them: Royal Elementor Addons, Essential Addons, “Addons for Elementor.” Each one you install is another vendor, another update cadence, another CVE feed you’re now responsible for.
Divi was close behind, in a couple of versions. Astra showed up on several sites, each flagged with a critical in the theme itself. And a handful of sites were on a WordPress core thirty-plus advisories behind — the kind of gap that only opens when auto-updates are off and nobody’s watching.
Why the fancy stuff is the dangerous stuff
It makes sense once you say it out loud. A page builder is a huge amount of code with a huge attack surface, and its add-on marketplace multiplies that surface by every extension you bolt on. Then two things happen: premium plugins don’t auto-update by default, and licenses quietly lapse, so the update that patches the CVE never installs. The plugin keeps working. It just stops getting fixed.
The result is exactly what we saw — the most capable, most popular tools, one or two versions behind, carrying holes that were patched months ago in a release nobody applied.
What to actually do
- Audit against a CVE list, not the “update available” badge. A plugin can be “up to date” on your dashboard and still be the latest vulnerable version. You need to check the version against known advisories, which is a different question.
- Delete the add-ons you’re not using. Every Elementor add-on you’re not actively rendering is pure risk with no upside. The fastest security win on most sites is uninstalling things.
- Keep premium licenses active. An expired license isn’t just lost support — it’s the reason the security patch never arrives.
Site Doctor checks every plugin, theme, and the core against a current vulnerability database on each scan, read-only, and tells you which specific version is exposed and how bad. But the five-minute version is free: list your plugins, note the versions, and look each one up. The names that come back are usually the ones you’d never have suspected because you trust them.