Skip to content
PluginCanary

Tainacan

by tainacan · 1,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 20 Oct 2026, 14 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for Tainacan
Ownership100
Maintenance100
Security60
SupportNo data
ReputationNo data

How the score works

Quick answers

Is Tainacan still maintained?
Yes. Last release 20 Oct 2026, 14 releases in the last 24 months. 20 Oct 2026 · wordpress.org
Who owns Tainacan, and has it changed hands?
No change recorded. Main committer vnmedeiros since Jul 2019. 3 Nov 2026 · SVN log
Was Tainacan removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is Tainacan safe?
22 known vulnerabilities, all fixed (latest in 1.4.0). Not on the exploited list. 27 Oct 2026 · Wordfence Intelligence
Is the latest Tainacan update safe to install?
No ownership change before 1.4.1. No one-star spike after it. 20 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
leogermani25 May 2018 to 20 Dec 2019, 62 commits
vnmedeiros11 Jul 2019 to 20 Oct 2026, 158 commits
wetah13 Aug 2021 to 13 Aug 2021, 2 commits

3 committers recorded. No ownership change since 2018.

Maintenance

Last release
15 days ago
Releases, 24 months
14
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Tainacan
Q1 20242
Q2 20247
Q3 20245
Q4 20242
Q1 20252
Q2 20251
Q3 20251
Q4 20253
Q1 20261
Q2 20261
Q3 20262
Q4 20262

Last release 20 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 5.0.

Rating distribution
5 star12
4 star0
3 star0
2 star0
1 star0

Security record

12 vulnerabilities in 24 months (22 on record), all patched (latest fixed in 1.4.0).

Show 22 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
27 Oct 2026Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment4.9<= 1.3.01.4.0Patched before disclosure
15 Oct 2026Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter6.5<= 1.3.01.4.0Patched before disclosure
14 Oct 2026Tainacan < 1.4.0 - Authenticated (Subscriber+) Information Exposure4.3< 1.4.01.4.0Patched before disclosure
8 Oct 2026Tainacan <= 1.3.0 - Authenticated (Custom Role+) PHP Object Injection7.5<= 1.3.01.4.0Patched before disclosure
23 Sep 2026Tainacan <= 1.2.0 - Authenticated (Subscriber+) SQL Injection6.5<= 1.2.01.3.0Patched before disclosure
7 Jul 2026Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter7.5<= 1.0.31.1.0Patched before disclosure
28 May 2026Tainacan <= 1.0.3 - Unauthenticated SQL Injection7.5<= 1.0.31.1.0Patched before disclosure
20 Dec 2025Tainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation5.3<= 1.0.11.0.2Patched before disclosure
20 Nov 2025Tainacan <= 1.0.0 - Reflected Cross-Site Scripting6.1<= 1.0.01.0.1Patched before disclosure
20 Nov 2025Tainacan <= 1.0.0 - Unauthenticated Information Exposure5.3<= 1.0.01.0.1Patched before disclosure
16 May 2025Tainacan <= 0.21.14 - Unauthenticated Arbitrary File Deletion5.3<= 0.21.140.21.15Patched before disclosure
22 Jan 2025Tainacan <= 0.21.12 - Authenticated (Subscriber+) SQL Injection6.5<= 0.21.120.21.13Patched before disclosure
10 Oct 2024Tainacan <= 0.21.10 - Reflected Cross-Site Scripting6.1<= 0.21.100.21.11Patched before disclosure
9 Oct 2024Tainacan <= 0.21.8 - Authenticated (Subscriber+) SQL Injection6.5<= 0.21.80.21.9Patched before disclosure
30 Jul 2024Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read6.5<= 0.21.70.21.8Patched before disclosure
20 May 2024PDF.js < 4.2.67 - Arbitrary JavaScript Execution6.4<= 0.21.50.21.619
20 May 2024Tainacan <= 0.21.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 0.21.30.21.4Patched before disclosure
20 May 2024Tainacan <= 0.21.3 - Unauthenticated Stored Cross-Site Scripting7.2<= 0.21.30.21.4Patched before disclosure
29 Mar 2024Tainacan <= 0.20.7 - Missing Authorization5.3<= 0.20.70.20.8Patched before disclosure
26 Feb 2024Tainacan <= 0.20.6 - Unauthenticated Sensitive Information Exposure5.3<= 0.20.60.20.71
20 Nov 2023Tainacan <= 0.20.4 - Reflected Cross-Site Scripting6.1<= 0.20.40.20.52
24 May 2022Tainacan <= 0.18.9 - Cross-Site Scripting7.2<= 0.18.90.18.101

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

1,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Tainacan
4 May 2026110
11 May 2026269
18 May 2026232
25 May 2026297
1 Jun 2026339
8 Jun 2026246
15 Jun 2026170
22 Jun 2026144
29 Jun 2026716
6 Jul 2026381
13 Jul 2026202
20 Jul 2026217
27 Jul 2026238
3 Aug 2026225
10 Aug 2026242
17 Aug 2026247
24 Aug 2026283
31 Aug 2026880
7 Sep 2026370
14 Sep 2026337
21 Sep 2026411
28 Sep 2026308
5 Oct 20261,075
12 Oct 2026754
19 Oct 20261,217
26 Oct 2026538
2 Nov 202644

Weekly downloads over the last 4 weeks are 64% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

WP Job ManagerScore 98 · 70,000+Simple Job BoardScore 96 · 10,000+HireZootScore 94 · 30,000+Business Directory PluginScore 88 · 10,000+

Facts

Version1.4.1
Authortainacan
Added25 May 2018
Last updated20 Oct 2026
Active installs1,000+
Requires WordPress6.5
Tested up to7.1.4
Requires PHP7.4
CategoryContent Management > Media Library & Asset Management
TagsGLAM, museums, archives, repository, collections

Other plugins by this author: Tainacan Support for Blocksy, Tainacan Extra View Modes, Tainacan URL Metadata Type

Questions

Is Tainacan still maintained?

Yes. Last release 20 Oct 2026, 14 releases in the last 24 months.

Who owns Tainacan, and has it changed hands?

No change recorded. Main committer vnmedeiros since Jul 2019.

Was Tainacan removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is Tainacan safe?

22 known vulnerabilities, all fixed (latest in 1.4.0). Not on the exploited list.

Is the latest Tainacan update safe to install?

No ownership change before 1.4.1. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue