ElasticPress
Healthy: maintained, last release 10 Sep 2026, 10 releases in 24 months, no unpatched vulnerabilities.
| Ownership | 100 |
|---|---|
| Maintenance | 100 |
| Security | 85 |
| Support | No data |
| Reputation | No data |
Quick answers
- Is ElasticPress still maintained?
- Yes. Last release 10 Sep 2026, 10 releases in the last 24 months. 10 Sep 2026 · wordpress.org
- Who owns ElasticPress, and has it changed hands?
- No change recorded. Main committer 10up since Mar 2022. 3 Nov 2026 · SVN log
- Was ElasticPress removed from wordpress.org?
- No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
- Is ElasticPress safe?
- 10 known vulnerabilities, all fixed (latest in 5.3.5). Not on the exploited list. 11 Sep 2026 · Wordfence Intelligence
- Is the latest ElasticPress update safe to install?
- No ownership change before 5.3.5. No one-star spike after it. 10 Sep 2026 · Release history
Active signals
Facts we detected, with links to the source.
No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| tlovett1 | 20 Oct 2014 to 15 Nov 2019, 52 commits |
|---|---|
| collinsinternet | 22 Aug 2018 to 26 Mar 2019, 15 commits |
| 10upbot | 23 Jul 2019 to 20 Dec 2021, 35 commits |
| 10up | 8 Mar 2022 to 10 Sep 2026, 35 commits |
| felipeelia | 11 Apr 2023 to 11 Apr 2023, 1 commits |
5 committers recorded. No ownership change since 2014.
Maintenance
- Last release
- 55 days ago
- Releases, 24 months
- 10
- Tested up to
- 7.1 current
- Requires PHP
- 7.4 supported 8.2+
| Q1 2024 | 1 |
|---|---|
| Q2 2024 | 4 |
| Q3 2024 | 0 |
| Q4 2024 | 1 |
| Q1 2025 | 0 |
| Q2 2025 | 1 |
| Q3 2025 | 0 |
| Q4 2025 | 3 |
| Q1 2026 | 2 |
| Q2 2026 | 1 |
| Q3 2026 | 2 |
| Q4 2026 | 0 |
Last release 10 Sep 2026. Tested with WordPress 7.1 (current).
Reputation
Last 90 days: no reviews. Lifetime: 4.2.
| 5 star | 23 |
|---|---|
| 4 star | 0 |
| 3 star | 1 |
| 2 star | 1 |
| 1 star | 5 |
Security record
1 vulnerability in 24 months (10 on record), patched (latest fixed in 5.3.5).
Show 10 patched vulnerabilities
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 11 Sep 2026 | ElasticPress <= 5.3.4 - Unauthenticated Information Exposure | 5.3 | <= 5.3.4 | 5.3.5 | Patched before disclosure |
| 6 Jun 2024 | ElasticPress <= 5.1.0 - Cross-Site Request Forgery | 4.3 | <= 5.1.0 | 5.1.1 | Patched before disclosure |
| 11 Apr 2023 | webpack JS package <= 5.75.0 - Sandbox Bypass | 8.3 | <= 4.5.0 | 4.5.1 | 1 |
| 5 Dec 2022 | simple-git < 3.15.0 - Remote Code Execution | 9.8 | <= 4.4.0 | 4.4.1 | 37 |
| 12 Oct 2022 | loader-utils (JS package) < 2.0.3 - Prototype Pollution | 5.4 | <= 4.3.1 | 4.4.0 | 49 |
| 11 Oct 2022 | loader-utils (JS package) < 3.2.1 - Regular Expression Denial of Service | 3.7 | <= 4.3.1 | 4.4.0 | 50 |
| 11 Oct 2022 | loader-utils (JS package) < 3.2.1 - Regular Expression Denial of Service | 3.7 | <= 4.3.1 | 4.4.0 | 50 |
| 14 Jul 2022 | terser (JS Package) < 5.14.2 - Denial of Service | 3.7 | <= 4.2.2 | 4.3.0 | 49 |
| 5 Apr 2022 | Moment.js <= 2.29.1 - Directory Traversal | 7.5 | <= 4.1.0 | 4.2.0 | 52 |
| 1 Mar 2021 | ElasticPress <= 3.5.3 - Cross-Site Request Forgery Bypass | 4.3 | <= 3.5.3 | 3.5.4 | Patched before disclosure |
Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.
Support
100% of 1 support threads resolved in the last 2 months.
Momentum
8,000+ active installs. History builds with each weekly snapshot.
| 4 May 2026 | 2,467 |
|---|---|
| 11 May 2026 | 3,283 |
| 18 May 2026 | 3,781 |
| 25 May 2026 | 3,020 |
| 1 Jun 2026 | 4,341 |
| 8 Jun 2026 | 4,810 |
| 15 Jun 2026 | 3,884 |
| 22 Jun 2026 | 3,764 |
| 29 Jun 2026 | 3,355 |
| 6 Jul 2026 | 3,783 |
| 13 Jul 2026 | 3,264 |
| 20 Jul 2026 | 3,912 |
| 27 Jul 2026 | 3,527 |
| 3 Aug 2026 | 3,569 |
| 10 Aug 2026 | 3,283 |
| 17 Aug 2026 | 3,216 |
| 24 Aug 2026 | 4,185 |
| 31 Aug 2026 | 4,687 |
| 7 Sep 2026 | 5,323 |
| 14 Sep 2026 | 5,291 |
| 21 Sep 2026 | 4,574 |
| 28 Sep 2026 | 4,619 |
| 5 Oct 2026 | 4,821 |
| 12 Oct 2026 | 4,494 |
| 19 Oct 2026 | 5,286 |
| 26 Oct 2026 | 4,854 |
| 2 Nov 2026 | 748 |
Weekly downloads over the last 4 weeks are 2% below the 27-week average.
Healthier alternatives
Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.
No healthier plugin in the same category yet.
Facts
| Version | 5.3.5 |
|---|---|
| Author | 10up |
| Added | 20 Oct 2014 |
| Last updated | 10 Sep 2026 |
| Active installs | 8,000+ |
| Requires WordPress | 6.2 |
| Tested up to | 7.1.4 |
| Requires PHP | 7.4 |
| Category | E-commerce & Shopping |
| Tags | fuzzy, search, performance, elasticsearch, related posts |
Other plugins by this author: Safe SVG, Simple Page Ordering, Ads.txt Manager, Simple Local Avatars, Safe Redirect Manager, Restricted Site Access, Autopost for X (formerly Autoshare for Twitter), Insert Special Characters, Convert to Blocks, Microsoft Azure Storage for WordPress, Block for Apple Maps, ElasticPress Debugging Add-On
Questions
Is ElasticPress still maintained?
Yes. Last release 10 Sep 2026, 10 releases in the last 24 months.
Who owns ElasticPress, and has it changed hands?
No change recorded. Main committer 10up since Mar 2022.
Was ElasticPress removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026.
Is ElasticPress safe?
10 known vulnerabilities, all fixed (latest in 5.3.5). Not on the exploited list.
Is the latest ElasticPress update safe to install?
No ownership change before 5.3.5. No one-star spike after it.