plugin
17 known security issues reported for the Age Gate WordPress plugin. Most recent disclosed Apr 9, 2025.
Running Age Gate on your site? Check whether your installed version is affected.
Scan your site freeThe Age Gate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the store() function in all versions up to, and including, 3.5.4. This makes it possible for unauthenticated attackers to update settings.
[en] Missing Authorization vulnerability in Phil Age Gate allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Age Gate: from n/a through 3.5.4.
The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of code in those files. This can be used...
The Age Gate plugin for WordPress is vulnerable to Open Redirects in versions up to, and including, 2.13.4 via the '_wp_http_referer' parameter. This makes it possible for unauthenticated attackers to send users redirection links to hostile sites by using the website's address.
The Age Gate plugin for WordPress is vulnerable to Open Redirects in versions up to, and including, 2.13.4 via the '_wp_http_referer' parameter. This makes it possible for unauthenticated attackers to send users redirection links to hostile sites by using the website's address.
[en] Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin <= 2.17.0 at WordPress.
The Age Gate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data imports in versions up to, and including, 2.17.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a...
Unauthenticated Import Settings vulnerability discovered in WordPress Age Gate (versions <= 2.17.0).
The Age Gate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Additional content’ field in versions up to, and including, 2.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will ex...
Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Martin Vierula (Trustwave) in WordPress Age Gate plugin (versions <= 2.16.3).
The Age Gate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Additional content’ field in versions up to, and including, 2.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will ex...
URL Redirection to Untrusted Site ('Open Redirect') vulnerability found by Ilca Lucian Florin in WordPress WordPress Age Gate plugin (versions <= 2.13.4).
The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting
The plugin patched an Unauthenticated Import Settings vulnerability. It was found to be exploited in the wild a few days after being patched.
The plugin does not sanitise and escape the 'Additional content' setting of its 'Messaging' page, which could allow users having access to such setting (by default admin, but the plugin has a feature to change this and allow access to lower privileged users) to perform Cross-Site Scripting attacks
The plugin takes the _wp_http_referer parameter to redirect users after some actions as well as after invalid or missing nonces, leading to an Unauthenticated Open Redirect issue
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free