Known vulnerabilities in WP Hide & Security Enhancer

Protect your website by concealing vulnerable WordPress traces, plugins, themes, login/admin url. 2FA, Captcha, Firewall, Security Headers etc.

3Reported vulnerabilities

7.5Highest CVSS score

2.9.1Latest version

50,000+Active installs

What to do now

Update WP Hide & Security Enhancer to 2.5.2 or later. 3 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 13, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2022-2538	Medium 6.1	0.7%	Before 1.8	`1.8`	August 29, 2022
CVE-2024-11585	High 7.5	0.6%	0 to 2.5.1 (inclusive) 0 to 2.5.1 (inclusive)	`2.5.2`	December 6, 2024
WF-aee59a8f-7f21-4572-b146-ab1b6350ddb1	High 7.5	—	1.3.9.2 and earlier	`1.4`	July 21, 2017

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.