Closed on wordpress.org on 11 Sep 2026. Reason: false. It no longer receives updates there.

Leyka

unknown active installs · Checked 3 Nov 2026

Avoid8 Criticals1 Warning

Avoid: Leyka is closed on wordpress.org and no longer gets updates.

Watch this plugin Check my site View on wordpress.org

10/ 100 Canary Score

Capped at 10 because the plugin is closed.

Sub-scores for Leyka
Ownership	100
Maintenance	10
Security	10
Support	70
Reputation	70

How the score works

Active signals

Facts we detected, with links to the source.

CriticalSEC-2Vulnerability published 7 Oct 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.21 Oct 2026Evidence
CriticalSEC-1Vulnerability published 7 Oct 2026 with no patched version yet. Disable or replace the plugin until a fix is released.7 Oct 2026Evidence
CriticalSEC-2Vulnerability published 19 Aug 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.2 Sep 2026Evidence
CriticalSEC-1Vulnerability published 19 Aug 2026 with no patched version yet. Disable or replace the plugin until a fix is released.19 Aug 2026Evidence
CriticalSEC-2Vulnerability published 1 Jul 2025 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.15 Jul 2025Evidence
CriticalSEC-2Vulnerability published 27 Jun 2025 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.11 Jul 2025Evidence
CriticalSEC-1Vulnerability published 1 Jul 2025 with no patched version yet. Disable or replace the plugin until a fix is released.1 Jul 2025Evidence
CriticalSEC-1Vulnerability published 27 Jun 2025 with no patched version yet. Disable or replace the plugin until a fix is released.27 Jun 2025Evidence
WarningCLS-1Closed on wordpress.org on 11 Sep 2026, reason: false. Replace this plugin. It no longer receives updates from wordpress.org.11 Sep 2026Evidence
InfoSEC-35 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Commit history is collected for plugins with 1,000+ installs or on a watchlist. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release: unknown
Releases, 24 months: 0
Tested up to: unknown vs 7.1
Requires PHP: not stated supported 8.2+

Release history builds as we see new versions.

Support

Support history appears after our first snapshots of the forum counts.

Security record

Published	Issue	CVSS	Affected	Fixed in	Days to patch
7 Oct 2026	Leyka <= 3.32.3 - Authenticated (Administrator+) SQL Injection	4.9	<= 3.32.3	No fix	n/a
19 Aug 2026	Leyka <= 3.32.3 - Missing Authorization	4.3	<= 3.32.3	No fix	n/a
1 Jul 2025	Leyka <= 3.31.9 - Unauthenticated Local File Inclusion	8.1	<= 3.31.9	No fix	n/a
27 Jun 2025	Leyka <= 3.31.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	6.4	<= 3.31.9	No fix	n/a
14 Feb 2025	Leyka <= 3.31.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	6.4	<= 3.31.8	3.31.9	n/a
14 Oct 2024	Leyka <= 3.31.6 - Missing Authorization	4.3	<= 3.31.6	3.31.7	n/a
6 Jun 2024	Leyka <= 3.31.1 - Missing Authorization	5.3	<= 3.31.1	3.31.2	n/a
12 Sep 2023	Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure	5.3	<= 3.30.7	3.30.7.1	n/a
23 Aug 2023	Leyka <= 3.30.3 - Authenticated (Administrator+) Stored Cross-Site Scripting	4.4	< 3.30.3	3.30.3	n/a
7 Aug 2023	Leyka <= 3.30.2 - Reflected Cross-Site Scripting	6.1	<= 3.30.2	3.30.3	n/a
22 May 2023	Leyka <= 3.30.2 - Privilege Escalation via Admin Password Reset	9.8	<= 3.30.2	3.30.3	n/a
22 May 2023	Leyka <= 3.30.1 - Reflected Cross-Site Scripting	6.1	<= 3.30.1	3.30.2	n/a
3 Mar 2023	Leyka <= 3.29.2 - Cross-Site Request Forgery	5.4	<= 3.29.2	3.30	n/a
3 Mar 2023	Leyka <= 3.29.2 - Unauthenticated Stored Cross-Site Scripting	7.2	<= 3.29.2	3.30	n/a

Source: Wordfence Intelligence.

Reputation

No ratings yet.

Momentum

unknown active installs. History builds with each weekly snapshot.

Momentum history builds with each snapshot.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

No healthier plugin in the same category yet.

Facts

Version	not stated
Author	not stated
Added	not stated
Last updated	not stated
Active installs	unknown
Requires WordPress	not stated
Tested up to	not stated
Requires PHP	not stated
Category	E-commerce & Shopping
Tags	not stated

Questions

Is Leyka still maintained?

No. Leyka was closed on wordpress.org on 11 Sep 2026 (false) and gets no updates there.

Is Leyka safe?

Leyka has 4 published vulnerabilities with no patched version. Its Canary status is Avoid.

Who owns Leyka?

The wordpress.org author is not listed. We have recorded no ownership change.

What can I use instead of Leyka?

We have no healthier plugin in the same category on record yet.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue