Skip to content
PluginCanary

Cincopa video and media plug-in

by nicashmu · 1,000+ active installs · Checked 3 Nov 2026
Avoid1 Critical

Avoid: vulnerability published 13 Oct 2026 still has no fix after 14 days.

39/ 100 Canary Score

Capped at 39: a vulnerability has no patch.

Sub-scores for Cincopa video and media plug-in
Ownership100
Maintenance85
Security10
Support70
Reputation70

How the score works

Quick answers

Is Cincopa video and media plug-in still maintained?
Yes. Last release 28 Jul 2026, 2 releases in the last 24 months. 28 Jul 2026 · wordpress.org
Who owns Cincopa video and media plug-in, and has it changed hands?
No change recorded. Main committer davitcincopa since Mar 2021. 3 Nov 2026 · SVN log
Was Cincopa video and media plug-in removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is Cincopa video and media plug-in safe?
No. 1 known vulnerability has no fix in the current version. 13 Oct 2026 · Wordfence Intelligence
Is the latest Cincopa video and media plug-in update safe to install?
No ownership change before 1.165. No one-star spike after it. 28 Jul 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • CriticalSEC-2Vulnerability published 13 Oct 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.27 Oct 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
nicashmu5 Jan 2011 to 28 Apr 2019, 121 commits
davitcincopa25 Mar 2021 to 28 Jul 2026, 26 commits

2 committers recorded. No ownership change since 2011.

Maintenance

Last release
3 months ago
Releases, 24 months
2
Tested up to
7.0 vs 7.1
Requires PHP
not stated supported 8.2+
Releases per quarter
Releases per quarter for Cincopa video and media plug-in
Q1 20242
Q2 20243
Q3 20240
Q4 20240
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20261
Q3 20261
Q4 20260

Last release 28 Jul 2026. Tested up to 7.0, 1 major version behind WordPress 7.1.

Reputation

Last 90 days: no reviews. Lifetime: 2.8.

Rating distribution
5 star9
4 star3
3 star0
2 star2
1 star12

Security record

4 vulnerabilities in 24 months (6 on record), 1 with no fix in the current version.

PublishedIssueCVSSAffectedFixed inDays to patch
13 Oct 2026Cincopa video and media plug-in <= 1.165 - Unauthenticated Stored Cross-Site Scripting7.2<= 1.165No fixn/a
Show 5 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
23 Jun 2026Cincopa video and media plug-in <= 1.163 - Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments7.2<= 1.1631.1646
31 Dec 2025Post Video Players <= 1.163 - Authenticated (Editor+) Stored Cross-Site Scripting4.4<= 1.163Not affectedn/a
31 Dec 2025Post Video Players <= 1.163 - Authenticated (Contributor+) Information Exposure4.3<= 1.163Not affectedn/a
30 Jan 2024Post Video Players <= 1.159 - Cross-Site Request Forgery via cincopa_mp_mt_options_page4.3<= 1.1591.16043
25 Aug 2015Cincopa video and media plug-in < 1.137 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1< 1.1371.1376

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

1,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Cincopa video and media plug-in
4 May 202629
11 May 202627
18 May 202628
25 May 202640
1 Jun 202626
8 Jun 202640
15 Jun 202618
22 Jun 202611
29 Jun 202618
6 Jul 20267
13 Jul 202614
20 Jul 20268
27 Jul 202641
3 Aug 202612
10 Aug 20266
17 Aug 2026625
24 Aug 2026178
31 Aug 2026126
7 Sep 2026122
14 Sep 2026126
21 Sep 2026124
28 Sep 2026136
5 Oct 2026124
12 Oct 2026120
19 Oct 2026167
26 Oct 2026159
2 Nov 202618

Weekly downloads over the last 4 weeks are 33% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Easy Video PlayerScore 91 · 20,000+Video GalleryScore 91 · 10,000+Video PopupScore 91 · 10,000+Embed Plus for YouTube GalleryScore 90 · 100,000+HTML5 Video PlayerScore 90 · 20,000+

Facts

Version1.165
Authornicashmu
Added5 Jan 2011
Last updated28 Jul 2026
Active installs1,000+
Requires WordPress5.0
Tested up to7.0.8
Requires PHPnot stated
Categorynot stated
Tagsmedia, video, photos, gallery, slideshow

Questions

Is Cincopa video and media plug-in still maintained?

Yes. Last release 28 Jul 2026, 2 releases in the last 24 months.

Who owns Cincopa video and media plug-in, and has it changed hands?

No change recorded. Main committer davitcincopa since Mar 2021.

Was Cincopa video and media plug-in removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is Cincopa video and media plug-in safe?

No. 1 known vulnerability has no fix in the current version.

Is the latest Cincopa video and media plug-in update safe to install?

No ownership change before 1.165. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue