Skip to content
PluginCanary

Wicked Folders

Wicked Folders - Folder Organizer for Pages, Posts, and Custom Post Types
by wickedplugins · 20,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 2 Oct 2026, 12 releases in 24 months, no unpatched vulnerabilities.

98/ 100 Canary Score
Sub-scores for Wicked Folders
Ownership100
Maintenance100
Security95
SupportNo data
ReputationNo data

How the score works

Quick answers

Is Wicked Folders still maintained?
Yes. Last release 2 Oct 2026, 12 releases in the last 24 months. 2 Oct 2026 · wordpress.org
Who owns Wicked Folders, and has it changed hands?
No change recorded. Main committer wickedplugins since Apr 2017. 4 Nov 2026 · SVN log
Was Wicked Folders removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Wicked Folders safe?
22 known vulnerabilities, all fixed (latest in 4.1.1). Not on the exploited list. 14 Mar 2026 · Wordfence Intelligence
Is the latest Wicked Folders update safe to install?
No ownership change before 4.2.0. No one-star spike after it. 2 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
wickedplugins8 Apr 2017 to 2 Oct 2026, 236 commits

1 committer recorded. No ownership change since 2017.

Maintenance

Last release
33 days ago
Releases, 24 months
12
Tested up to
7.1 current
Requires PHP
not stated supported 8.2+
Releases per quarter
Releases per quarter for Wicked Folders
Q1 20242
Q2 20243
Q3 20242
Q4 20242
Q1 20252
Q2 20252
Q3 20251
Q4 20252
Q1 20261
Q2 20262
Q3 20260
Q4 20261

Last release 2 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.9.

Average rating per quarter for Wicked Folders
Q1 20245.0
Q2 20245.0
Q4 20245.0
Q4 20253.0
Q2 20265.0

Average rating stayed at 5.0 between Q1 2024 and Q2 2026.

Rating distribution
5 star53
4 star0
3 star3
2 star0
1 star0

Security record

1 vulnerability in 24 months (22 on record), patched (latest fixed in 4.1.1).

Show 22 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
14 Mar 2026Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion4.3<= 4.1.04.1.1Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Missing Authorization on ajax_move_object5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_state5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Missing Authorization on ajax_add_folder5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Missing Authorization via ajax_delete_folder5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Missing Authorization on ajax_edit_folder5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_folder_order5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_save_folder5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_edit_folder5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_add_folder5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Missing Authorization on ajax_clone_folder5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Missing Authorization via ajax_save_state5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_move_object5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_delete_folder5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_clone_folder5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder_order5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_sort_order5.4<= 2.18.162.18.17Patched before disclosure
7 Feb 2023Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_sort_order5.4<= 2.18.162.18.17Patched before disclosure
6 Feb 2023Wicked Folders <= 2.18.16 - Missing Authorization via ajax_unassign_folders5.4<= 2.18.162.18.171
6 Feb 2023Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_unassign_folders5.4<= 2.18.162.18.171
30 Dec 2021Wicked Folders <= 2.18.9 - Subscriber+ SQL Injection8.8<= 2.18.92.18.101

Changelog mentions of security fixes: 4.2.0 (security, SQL injection).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

0% of 1 support threads resolved in the last 2 months.

Momentum

20,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Wicked Folders
4 May 2026395
11 May 20261,145
18 May 20262,163
25 May 2026989
1 Jun 2026826
8 Jun 2026757
15 Jun 2026704
22 Jun 20268,233
29 Jun 20262,697
6 Jul 20262,735
13 Jul 20261,212
20 Jul 20261,159
27 Jul 2026932
3 Aug 2026943
10 Aug 2026819
17 Aug 2026822
24 Aug 2026867
31 Aug 2026808
7 Sep 2026702
14 Sep 2026710
21 Sep 2026987
28 Sep 20267,411
5 Oct 20264,987
12 Oct 20261,757
19 Oct 20261,992
26 Oct 20261,414
2 Nov 2026192

Weekly downloads over the last 4 weeks are 25% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

reGenerate Thumbnails AdvancedScore 100 · 60,000+File Upload Types by WPFormsScore 100 · 40,000+WP SVG ImagesScore 100 · 30,000+No Right Click ImagesScore 100 · 20,000+Media Library CategoriesScore 100 · 20,000+

Facts

Version4.2.0
Authorwickedplugins
Added6 Apr 2017
Last updated2 Oct 2026
Active installs20,000+
Requires WordPress4.6
Tested up to7.1.4
Requires PHPnot stated
CategorySite Administration & Utilities > Site Migration & Cloning
Tagsfolders, organization, page folders, media library folders, media library categories

Other plugins by this author: Wicked Block Conditions, Easy Email, Wicked Block Builder

Questions

Is Wicked Folders still maintained?

Yes. Last release 2 Oct 2026, 12 releases in the last 24 months.

Who owns Wicked Folders, and has it changed hands?

No change recorded. Main committer wickedplugins since Apr 2017.

Was Wicked Folders removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Wicked Folders safe?

22 known vulnerabilities, all fixed (latest in 4.1.1). Not on the exploited list.

Is the latest Wicked Folders update safe to install?

No ownership change before 4.2.0. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue