WPComplete
Avoid: vulnerability published 18 Sep 2026 still has no fix after 14 days.
Capped at 39 while a vulnerability has no patch.
| Ownership | 100 |
|---|---|
| Maintenance | 100 |
| Security | 0 |
| Support | 70 |
| Reputation | 70 |
Active signals
Facts we detected, with links to the source.
- CriticalSEC-2Vulnerability published 18 Sep 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.2 Oct 2026Evidence
- WarningSEC-1Vulnerability published 8 Oct 2026, fixed in 2.9.5.7. Update to version 2.9.5.7 or later.8 Oct 2026Evidence
- WarningSEC-1Vulnerability published 20 Aug 2026, fixed in 2.9.5.7. Update to version 2.9.5.7 or later.20 Aug 2026Evidence
- InfoSEC-38 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| zackgilbert | 12 Aug 2016 to 9 Oct 2020, 51 commits |
|---|---|
| jthillithemes | 24 Aug 2021 to 26 Aug 2021, 2 commits |
| layotte | 27 Dec 2022 to 5 Jan 2023, 2 commits |
| bordoni | 24 Jun 2025 to 14 Oct 2025, 9 commits |
| stellarwp | 27 Jun 2025 to 27 Jun 2025, 2 commits |
| dpantazis | 4 May 2026 to 4 May 2026, 2 commits |
| redscar | 8 Jun 2026 to 18 Aug 2026, 4 commits |
| larodiel | 7 Oct 2026 to 7 Oct 2026, 2 commits |
New committer larodiel made a first commit on 7 Oct 2026. New committer redscar made a first commit on 8 Jun 2026.
Maintenance
- Last release
- 28 days ago
- Releases, 24 months
- 8
- Tested up to
- 7.1 current
- Requires PHP
- not stated supported 8.2+
| Q1 2024 | 0 |
|---|---|
| Q2 2024 | 0 |
| Q3 2024 | 0 |
| Q4 2024 | 0 |
| Q1 2025 | 0 |
| Q2 2025 | 1 |
| Q3 2025 | 2 |
| Q4 2025 | 1 |
| Q1 2026 | 0 |
| Q2 2026 | 2 |
| Q3 2026 | 1 |
| Q4 2026 | 1 |
Last release 7 Oct 2026. Tested with WordPress 7.1 (current).
Support
Support history appears after our first snapshots of the forum counts.
Security record
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 8 Oct 2026 | WPComplete <= 2.9.5.6 - Cross-Site Request Forgery | 4.3 | <= 2.9.5.6 | 2.9.5.7 | 0 |
| 18 Sep 2026 | WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute | 6.4 | <= 2.9.9.0 | No fix | n/a |
| 20 Aug 2026 | WPComplete <= 2.9.5.6 - Unauthenticated Stored Cross-Site Scripting | 7.2 | <= 2.9.5.6 | 2.9.5.7 | 0 |
| 26 Jun 2026 | WPComplete <= 2.9.5.5 - Missing Authorization | 4.3 | <= 2.9.5.5 | 2.9.5.6 | 0 |
| 29 May 2026 | WPComplete <= 2.9.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting | 6.4 | <= 2.9.5.4 | 2.9.5.5 | 0 |
| 24 Oct 2025 | WPComplete <= 2.9.5.3 - Missing Authorization | 5.3 | <= 2.9.5.3 | 2.9.5.4 | 0 |
| 22 Sep 2025 | WPComplete <= 2.9.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting | 6.4 | <= 2.9.5.2 | 2.9.5.3 | 0 |
| 19 Jun 2025 | WPComplete <= 2.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting | 6.4 | <= 2.9.5 | 2.9.5.1 | 5 |
| 27 Jan 2023 | WPComplete <= 2.9.4 - Reflected Cross-Site Scripting | 6.1 | < 2.9.5 | 2.9.5 | 0 |
Source: Wordfence Intelligence.
Reputation
Lifetime rating 4.1 from 43 ratings. Quarterly trends appear as new reviews arrive.
| 5 star | 33 |
|---|---|
| 4 star | 0 |
| 3 star | 0 |
| 2 star | 1 |
| 1 star | 9 |
Momentum
1,000+ active installs. History builds with each weekly snapshot.
| 4 May 2026 | 57 |
|---|---|
| 11 May 2026 | 76 |
| 18 May 2026 | 94 |
| 25 May 2026 | 118 |
| 1 Jun 2026 | 61 |
| 8 Jun 2026 | 440 |
| 15 Jun 2026 | 71 |
| 22 Jun 2026 | 70 |
| 29 Jun 2026 | 68 |
| 6 Jul 2026 | 84 |
| 13 Jul 2026 | 51 |
| 20 Jul 2026 | 49 |
| 27 Jul 2026 | 59 |
| 3 Aug 2026 | 81 |
| 10 Aug 2026 | 75 |
| 17 Aug 2026 | 529 |
| 24 Aug 2026 | 139 |
| 31 Aug 2026 | 91 |
| 7 Sep 2026 | 79 |
| 14 Sep 2026 | 104 |
| 21 Sep 2026 | 122 |
| 28 Sep 2026 | 108 |
| 5 Oct 2026 | 575 |
| 12 Oct 2026 | 211 |
| 19 Oct 2026 | 197 |
| 26 Oct 2026 | 199 |
| 2 Nov 2026 | 24 |
Weekly downloads over the last 4 weeks are 11% above the 27-week average.
Healthier alternatives
Same category, higher Canary Score. Never sponsored.
Facts
| Version | 2.9.5.8 |
|---|---|
| Author | Nexcess |
| Added | 12 Aug 2016 |
| Last updated | 7 Oct 2026 |
| Active installs | 1,000+ |
| Requires WordPress | 4.5.3 |
| Tested up to | 7.1.4 |
| Requires PHP | not stated |
| Category | Learning Management Systems (LMS) > Course Creation & Management |
| Tags | learning, teaching, membership, courses lms, progress bar |
Other plugins by this author: Kadence Security - Password, Two Factor Authentication, and Brute Force Protection, The Events Calendar, Kadence Blocks - Page Builder Toolkit for Gutenberg Editor, Kadence Starter Templates - Predesigned Website Templates, GiveWP - Donation Plugin and Fundraising Platform, Image Widget, Event Tickets and Registration, Kadence WooCommerce Email Designer, Kadence Central - Site Management, Backups, Security, and Reporting, Virtue/Ascend/Pinnacle Toolkit, Membership Plugin - Kadence Memberships, GiveWP Donation Widgets for Elementor
Questions
Is WPComplete still maintained?
WPComplete was last updated on 7 Oct 2026. Its Canary status is Avoid.
Is WPComplete safe?
WPComplete has 1 published vulnerability with no patched version. Its Canary status is Avoid.
Who owns WPComplete?
The wordpress.org author is Nexcess. Recent committers: larodiel, redscar, dpantazis, bordoni, stellarwp. New committer larodiel made a first commit on 7 Oct 2026.
What can I use instead of WPComplete?
Plugins in the same category with a higher Canary Score: LearnPress - Course Wishlist, Sensei LMS Certificates, LifterLMS Labs, LearnPress - bbPress Integration, Custom Template for LearnDash.