PLUGIN SECURITY
Is Option Tree safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Option Tree WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
option-tree - Requires PHP: 5.3.0+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
- OptionTree [option-tree] < 2.7.0 (closed) [CVE-2019-15319, Option Tree <= 2.6.0 - PHP Object Injection, Option Tree < 2.7.0 - PHP Object Injection]
- OptionTree [option-tree] < 2.7.3 (closed) [CVE-2019-15320, Option Tree <= 2.7.2 - Object Injection Bypass]
- OptionTree [option-tree] < 2.7.3 (closed) [CVE-2019-15321, Option Tree <= 2.7.2 - Object Injection Bypass, Option Tree < 2.7.3 - Object Injection Bypass]
- OptionTree [option-tree] < 2.6.0 (closed) [CVE-2016-10895, Option Tree <= 2.5.5 - Cross-Site Scripting, OptionTree <= 2.5.5 - Authenticated Cross-Site Scripting (XSS)]
- OptionTree [option-tree] < 2.5.4 (closed) [CVE-2015-9320, Option Tree <= 2.5.3 - Cross-Site Scripting, Option Tree < 2.5.4 - XSS]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- Redux Framework — 900000+ active installs — max PHP 8.4
- CMB2 — 300000+ active installs — max PHP 8.4
- ACF Options For Polylang — 10000+ active installs — max PHP 8.4
- Options Framework — 10000+ active installs
- AAA Option Optimizer — 9000+ active installs
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.