How many vulnerabilities does WhoChanged have?

The audit found 80 findings: 1 critical, 6 high, 48 medium severity.

Should I use WhoChanged?

Based on the latest audit (grade C, risk CRITICAL), review the 80 findings on this page before deciding — higher-risk findings should be weighed against the plugin's alternatives.

WhoChanged

Q: Is WhoChanged secure?

WP HealthKit's independent audit rates WhoChanged overall risk as CRITICAL with a report-card grade of C.

Audited at release

v1.1.3WordPress PluginAudited 64 days ago

CRITICAL

Total Findings

Security Grade

Security Findings

Critical1

High6

Medium48

Low9

Info16

Executive Summary

Is WhoChanged secure? In WP HealthKit's independent 2026 audit, WhoChanged received an overall risk of CRITICAL and a report-card grade of C across 80 findings (1 critical, 6 high severity).

Directory audit — deterministic scanners only (Wordfence, OSV, PHPCS, PHPStan, Semgrep, Psalm, compat). Sign in and run a full audit for AI-grade analysis (security, quality, accessibility).

Security Report Card

Audit Your Plugin

Get a comprehensive security audit for your WordPress plugin or theme. Upload your zip and get results in minutes.

Start Free Audit

PHP Compatibility

Requires PHP 8.0Declared minimum: 7.4Mismatch detected

Categories with Findings

compatibilityPHP CompatibilityDatabaseCoding StandardsPHP CompatibilityAuth & AuthorizationType SafetyWooCommerce CompatibilityHook WiringGDPR

Plugin Info

Requires WP: 6.0+
Tested Up To: 7.0.4
Requires PHP: 7.4+
Audit Count: 1
Type: plugin

Embed Audit Badge

Show your audit status in your README or website.

[![WhoChanged security audit by WP HealthKit](https://wphealthkit.com/api/badge/by-slug/whochanged)](https://wphealthkit.com/directory/whochanged)

Paste this in your GitHub README or any Markdown file. The badge updates automatically on every re-audit — no need to refresh the snippet.

Site owners: should they update? See the update-safety verdict for WhoChanged

Are you the developer?

Claim this listing to get a Verified badge, control public audits, and get automatic re-scans.

Claim This Plugin

PHP Compatibility

Requires PHP 8.0Declared minimum: 7.4Mismatch detected

Categories with Findings

compatibilityPHP CompatibilityDatabaseCoding StandardsPHP CompatibilityAuth & AuthorizationType SafetyWooCommerce CompatibilityHook WiringGDPR