WP-Safety

WP AutoKeyword Security & Risk Analysis

wordpress.org/plugins/wp-autokeyword

WP AutoKeyword automatically suggests and generate keywords for all of your published post and add them automatically into your blog meta tags.

300 active installs v1.0 PHP 5.2+ WP 5.0+ Updated Apr 28, 2025
keywordkeyword-adderkeyword-generatormetatagseo
33
D · High Risk
CVEs total4
Unpatched4
Last CVEJun 5, 2025
Plugin page Download
Safety Verdict

Is WP AutoKeyword Safe to Use in 2026?

High Risk

Score 33/100

WP AutoKeyword carries significant security risk with 4 known CVEs, 4 still unpatched. Consider switching to a maintained alternative.

4 known CVEs 4 unpatched Last CVE: Jun 5, 2025Updated 1yr ago
Risk Assessment

The wp-autokeyword plugin v1.0 exhibits a concerning security posture, primarily due to a significant number of unprotected entry points and a history of severe vulnerabilities. All 14 identified AJAX handlers lack authentication checks, creating a wide attack surface that could be exploited by unauthenticated users. Furthermore, the taint analysis reveals 5 high-severity flows with unsanitized paths, indicating a strong likelihood of exploitable vulnerabilities such as Cross-Site Scripting (XSS) or SQL Injection.

Key Concerns

  • Unprotected AJAX handlers (14)
  • High severity taint flows (5)
  • Unpatched high severity CVE (1)
  • Unpatched medium severity CVEs (3)
  • Low percentage of properly escaped output
  • No nonce checks on AJAX handlers
  • No capability checks
  • SQL queries not always prepared
Vulnerabilities
4 published

WP AutoKeyword Security Vulnerabilities

CVEs by Year

4 CVEs in 2025 · unpatched
2025
Patched Has unpatched

Severity Breakdown

High
1
Medium
3

4 total CVEs

CVE-2025-28997medium · 5.3Missing Authorization

WP AutoKeyword <= 1.0 - Missing Authorization

Jun 5, 2025Unpatched
CVE-2025-32582medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

WP AutoKeyword <= 1.0 - Reflected Cross-Site Scripting

Apr 10, 2025Unpatched
CVE-2025-31870medium · 5.3Missing Authorization

WP AutoKeyword <= 1.0 - Missing Authorization to Arbitrary Content Deletion

Apr 1, 2025Unpatched
CVE-2025-31579high · 7.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

WP AutoKeyword <= 1.0 - Unauthenticated SQL Injection

Mar 31, 2025Unpatched
Version History

WP AutoKeyword Release Timeline

No version history available.
Code Analysis
Analyzed Mar 16, 2026

WP AutoKeyword Code Analysis

Dangerous Functions
0
Raw SQL Queries
7
10 prepared
Unescaped Output
41
1 escaped
Nonce Checks
0
Capability Checks
0
File Operations
0
External Requests
0
Bundled Libraries
0

SQL Query Safety

59% prepared17 total queries

Output Escaping

2% escaped42 total outputs
Data Flows · Security
6 unsanitized

Data Flow Analysis

6 flows6 with unsanitized paths
wpak_GuessKeyword (wp_ak_functions.php:239)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
14 unprotected

WP AutoKeyword Attack Surface

Entry Points14
Unprotected14

AJAX Handlers 14

noprivwp_ajax_wpakGuessKeywordwp_ak_functions.php:236
authwp_ajax_wpakGuessKeywordwp_ak_functions.php:237
noprivwp_ajax_wpakBulkKeywordwp_ak_functions.php:265
authwp_ajax_wpakBulkKeywordwp_ak_functions.php:266
noprivwp_ajax_wpakAddKeywordwp_ak_functions.php:379
authwp_ajax_wpakAddKeywordwp_ak_functions.php:380
noprivwp_ajax_wpakPaginationDatawp_ak_functions.php:456
authwp_ajax_wpakPaginationDatawp_ak_functions.php:457
noprivwp_ajax_wpakViewDatawp_ak_functions.php:540
authwp_ajax_wpakViewDatawp_ak_functions.php:541
noprivwp_ajax_wpakDeleteRowwp_ak_functions.php:627
authwp_ajax_wpakDeleteRowwp_ak_functions.php:628
noprivwp_ajax_wpakUpdateCellwp_ak_functions.php:655
authwp_ajax_wpakUpdateCellwp_ak_functions.php:656
WordPress Hooks 3
actionadmin_menuWP-AutoKeyword.php:532
actionadmin_enqueue_scriptswp_ak_functions.php:9
actionwp_headwp_ak_functions.php:619
Maintenance & Trust

WP AutoKeyword Maintenance & Trust

Maintenance Signals

WordPress version tested6.8.5
Last updatedApr 28, 2025
PHP min version5.2
Downloads9K

Community Trust

Rating60/100
Number of ratings4
Active installs300
Alternatives

WP AutoKeyword Alternatives

GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools

GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools

getgenie

A
95

GPT-4o powered AI content writer with 37+ templates, chatbot, AI image, NLP keyword research, SEO analysis for WordPress, Gutenberg & Elementor.

80K 4 CVEs
Simple SEO

Simple SEO

cds-simple-seo

A
91

Allows the modification of META titles, descriptions and keywords for all pages and posts. Also allows for default setting for of META title, descript &hellip;

10K 6 CVEs
Surfer – WordPress Plugin

Surfer – WordPress Plugin

surferseo

A
97

Connect Surfer's Content Editor to WordPress. Write and optimize your articles for SEO, find new keyword ideas and publish straight to WordPress.

6K 3 CVEs
Smart SEO Tool – SEO优化插件

Smart SEO Tool – SEO优化插件

smart-seo-tool

A
99

Smart SEO Tool是一款专门针对WordPress开发的智能SEO优化插件，与众多WordPress的SEO插件不一样的是，Smart SEO Tool更加简单易用，帮助站长快速完成WordPress博客/网站的SEO基础优化。

5K 2 CVEs
Codevyne SEO Meta Keywords

Codevyne SEO Meta Keywords

wpcc-seo-meta-keywords

A
92

Short Description: Add wordpress website page, post and product SEO meta keywords to speedup your website google search engine visibility.

4K No CVEs
Developer Profile

WP AutoKeyword Developer Profile

EXEIdeas International

1 plugin · 300 total installs

47
trust score
Avg Security Score
33/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect WP AutoKeyword

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/wp-autokeyword/css/exe_wpak_css.css/wp-content/plugins/wp-autokeyword/js/exe_wpak_js.js
Script Paths
/wp-content/plugins/wp-autokeyword/js/exe_wpak_js.js
Version Parameters
wp-autokeyword/css/exe_wpak_css.css?ver=wp-autokeyword/js/exe_wpak_js.js?ver=

HTML / DOM Fingerprints

CSS Classes
exe_wpak_pluginexe_successexe_errorexe_warningexe_noticeboxShaowlds-heartcol23+7 more
Data Attributes
title
FAQ

Frequently Asked Questions about WP AutoKeyword