WP-LESS Security & Risk Analysis
wordpress.org/plugins/wp-lessImplementation of LESS (Leaner CSS) in order to make themes development easier.
Is WP-LESS Safe to Use in 2026?
Generally Safe
Score 91/100WP-LESS has a strong security track record. Known vulnerabilities have been patched promptly. It's a solid choice for most WordPress installations.
The static analysis of wp-less v1.9.8 reveals an exceptionally clean codebase with no apparent attack surface in the form of AJAX handlers, REST API routes, shortcodes, or cron events. The absence of dangerous function usage, raw SQL queries, unescaped output, file operations, and external HTTP requests is a strong indicator of good security practices. Furthermore, the complete lack of taint analysis findings suggests no identifiable vulnerabilities related to unsanitized data flows.
However, the plugin's vulnerability history presents a significant concern. With one known CVE, specifically related to 'Exposure of Sensitive Information to an Unauthorized Actor,' and a stated last vulnerability date of April 1st, 2025, it indicates that previous versions have had exploitable weaknesses. The fact that this CVE is currently unpatched and carries a medium severity rating suggests a potential for ongoing risk if users are not on the latest secure version or if the patch has not been widely applied. While the current version's code analysis is stellar, the historical context necessitates caution.
In conclusion, the current version of wp-less v1.9.8 exhibits an excellent security posture based on static code analysis, demonstrating robust coding practices. The primary weakness lies in its past vulnerability history, specifically the unpatched medium-severity CVE related to information exposure. This historical pattern, despite the current code's cleanliness, warrants vigilance and a strong recommendation to ensure all instances are updated to a version that has addressed this specific vulnerability.
Key Concerns
- One unpatched medium severity CVE
WP-LESS Security Vulnerabilities
CVEs by Year
Severity Breakdown
1 total CVE
WP-LESS <= 1.9.6 - Unauthenticated Sensitive Information Disclosure
WP-LESS Release Timeline
WP-LESS Code Analysis
WP-LESS Attack Surface
Maintenance & Trust
WP-LESS Maintenance & Trust
Maintenance Signals
Community Trust
WP-LESS Alternatives
WP Add Custom CSS
wp-add-custom-css
Add custom css to the whole website and to specific posts and pages.
Add Admin CSS
add-admin-css
Easily define additional CSS (inline and/or by URL) to be added to all administration pages.
Core Framework
core-framework
Say hello to Core Framework - a FREE modular CSS framework platform.
Custom CSS and JavaScript
custom-css-and-javascript
Easily add custom CSS and JavaScript code to your WordPress site, with draft previewing, revisions, and minification!
Better WordPress Minify
bwp-minify
Allows you to combine and minify your CSS and JS files to improve page load time.
WP-LESS Developer Profile
3 plugins · 10K total installs
How We Detect WP-LESS
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/wp-less/lib/less.php/wp-content/plugins/wp-less/lib/less/Less.php/wp-content/plugins/wp-less/lib/less/Tree/Anonymous.php/wp-content/plugins/wp-less/lib/less/Tree/Rule.php/wp-content/plugins/wp-less/lib/less/Tree/Value.php/wp-content/plugins/wp-less/lib/less/Tree/Keyword.php/wp-content/plugins/wp-less/lib/less/Tree/Variable.php/wp-content/plugins/wp-less/lib/less/Tree/Call.php+59 more/wp-content/plugins/wp-less/lib/less.min.js/wp-content/plugins/wp-less/lib/wp-less.jsHTML / DOM Fingerprints
This file tends to be included in any development.In a sentence, in every case where you don't want to use WP-LESS as a standalone.Once included, it's up to you to use the available toolkit for your needs.How to use?+13 moreWPLessPlugin