Known vulnerabilities in Classic Editor +

The "Classic Editor +" plugin disables the block editor, removes enqueued scripts/styles and brings back classic Widgets.

1Reported vulnerabilities

8.8Highest CVSS score

4.4.2Latest version

40,000+Active installs

What to do now

Update Classic Editor + to 2.6.4 or later. 1 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 16, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
WF-e647d1ff-2d2c-43e4-b723-28ed410c4b3a	High 8.8	—	2.6.3 and earlier	`2.6.4`	January 24, 2022

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.