Is Astra Sites safe?

Plugin details

• Slug: astra-sites
• Requires PHP: 7.4+
• Max supported PHP (analyzed): 8.4

Known vulnerabilities

• Starter Templates – AI-Powered Templates for Elementor &amp; Gutenberg [astra-sites] < 2.7.1 [CVE-2021-42360, WordPress Starter Templates plugin <= 2.7.0 - Authenticated Block Import leading to Stored Cross-Site Scripting (XSS) vulnerability, Starter Templates &lt; 2.7.1 - Contributor+ Block Import to Stored XSS, Starter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 - Missing Authorization to Stored Cross-Site Scripting]
• Starter Templates – AI-Powered Templates for Elementor &amp; Gutenberg [astra-sites] < 3.1.21 [CVE-2022-46851, WordPress Starter Templates Plugin <= 3.1.20 is vulnerable to Cross Site Request Forgery (CSRF), Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 3.1.20 - Cross-Site Request Forgery in add_to_favorite, Starter Templates &lt;= 3.1.20 - Settings Update via CSRF]
• Starter Templates – AI-Powered Templates for Elementor &amp; Gutenberg [astra-sites] < 3.2.5 [CVE-2023-41804, Starter Templates <= 3.2.4 - Authenticated (Contributor+) Server-Side Request Forgery, WordPress Starter Templates Plugin <= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF), Starter Templates &lt;= 3.2.4 - Authenticated (Contributor+) Server-Side Request Forgery]
• Starter Templates – AI-Powered Templates for Elementor &amp; Gutenberg [astra-sites] < 3.2.6 [CVE-2023-41805, Starter Templates <= 3.2.5 - Incorrect Authorization, WordPress Starter Templates Plugin <= 3.2.5 is vulnerable to Broken Access Control, Starter Templates &lt;= 3.2.5 - Incorrect Authorization]
• Starter Templates – AI-Powered Templates for Elementor &amp; Gutenberg [astra-sites] < 3.2.5 [CVE-2023-34370]

+ 5 more known vulnerabilities

• Starter Templates – AI-Powered Templates for Elementor &amp; Gutenberg [astra-sites] < 4.1.7 [CVE-2024-1467, Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery, WordPress Starter Templates Plugin <= 4.1.6 is vulnerable to Server Side Request Forgery (SSRF)]
• Starter Templates – AI-Powered Templates for Elementor &amp; Gutenberg [astra-sites] < 4.2.2 [CVE-2024-4630, Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting, WordPress Starter Templates Plugin <= 4.2.1 is vulnerable to Cross Site Scripting (XSS)]
• Starter Templates – AI-Powered Templates for Elementor &amp; Gutenberg [astra-sites] < 4.4.1 [CVE-2024-47345, WordPress Starter Templates Plugin <= 4.4.0 is vulnerable to Cross Site Scripting (XSS), Starter Templates <= 4.4.0 - Authenticated (Author+) Stored Cross-Site Scripting]
• Starter Templates – AI-Powered Templates for Elementor &amp; Gutenberg [astra-sites] < 4.4.10 [CVE-2025-24568, WordPress Starter Templates Plugin <= 4.4.9 is vulnerable to Cross Site Request Forgery (CSRF), Starter Templates <= 4.4.9 - Cross-Site Request Forgery, EUVD-2025-3776]
• Starter Templates – AI-Powered Templates for Elementor &amp; Gutenberg [astra-sites] < 4.4.42 [CVE-2025-13065, Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass, EUVD-2025-201543]

Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.

Safer / more established alternatives

• Classic Editor — 9000000+ active installs — max PHP 8.4
• Advanced Editor Tools — 1000000+ active installs — max PHP 8.4
• Disable Gutenberg — 500000+ active installs — max PHP 8.4
• Shortcodes Ultimate – Content Elements — 400000+ active installs
• Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns — 200000+ active installs