Skip Navigation

This thread is resolved. Here is a description of the problem and solution.

Problem:
The client's site was flagged by Wordfence for having two potentially abandoned and insecure plugins: WPML Sticky Links and WPML CMS Navigation. The client is concerned about the security implications due to these plugins being labeled as abandoned, with no updates shown in 5 years.
Solution:
We reassured the client that both WPML Sticky Links and WPML CMS Navigation are still maintained for security and functionality despite not having recent updates. If these plugins are not actively used on the site, they can be safely deactivated. For more detailed information on these plugins, you can visit the following links:

If further assistance is needed or if the solution provided does not resolve the issue, we recommend opening a new support ticket. It's also advisable to check related known issues at https://wpml.org/known-issues/, verify the version of the permanent fix, and confirm that you have installed the latest versions of themes and plugins. For further assistance, please visit our support forum at WPML Support Forum.

This is the technical support forum for WPML - the multilingual WordPress plugin.

Everyone can read, but only WPML clients can post here. WPML team is replying on the forum 6 days per week, 22 hours per day.

Tagged: 

This topic contains 3 replies, has 1 voice.

Last updated by Dražen 3 months ago.

Assisted by: Dražen.

Author Posts
March 16, 2025 at 2:37 pm #16821767

scaiso

Background of the issue:
Our site was recently hacked, so we are trying to tighten up any vulnerabilities. Our Wordfence software has labeled two plugins as abandoned and a possible security threat: WPML Sticky Links and WPML CMS Navigation. Both are showing no updates in 5 years.

Symptoms:
No visible issues, but concerned about the security of our site due to plugins being labeled as abandoned.

Questions:
Are these plugins needed?
Is there an update to them that I am missing?
Can these plugins be removed?

March 16, 2025 at 8:05 pm #16822357

Itamar
WPML Supporter since 02/2016

Languages: English (English )

Timezone: Asia/Jerusalem (GMT+03:00)

Hi,

Thank you for contacting WPML support. While you wait for one of my colleagues to take this ticket and work on it, let me provide you with the first debugging steps or see if I can help with the issue quickly.

We can asure you that we are maintaining development and security of the WPML Sticky Links and WPML CMS Navigation plugins. You can read about those plugins here.

https://wpml.org/documentation/support/cms-navigation/
https://wpml.org/documentation/getting-started-guide/sticky-links/

There is a big likelihood that youdon't need the WPML CMS Navigation plugin. The same goes for the WPML Sticky Links plugin. Please check our guide, and if you are not using those plugins, you can safely deactivate them.

If you need further help with this issue please share your site's Debug information. You can read about it here.

http://wpml.org/faq/provide-debug-information-faster-support/

Regards,
Itamar.

March 20, 2025 at 8:37 pm #16841890

scaiso

I have attached the Debug Information from our site hidden link. My question is several plugins are marked as abandoned by our security software Webfence. I am concerned about that since we have been hacked and I want to secure up our site by removing unnecessary and abandoned plugins. I have attached a file containing the messages we receive from Websense. I would like to remove those plugins or update them with more current versions.

Debug Info:

plugins listed as abandoned.png
March 21, 2025 at 7:25 am #16842828

Dražen
Supporter

Languages: English (English )

Timezone: Europe/Zagreb (GMT+02:00)

Hello,

the warning is displayed because the plugin was not updated in 2 years.

I checked with our development team and we run tests with every WP/WPML/Plugins update. Since the plugin continued to work correctly and we didn't have any major issues, no update was released. They are not abandoned, but if you wish and do not use them you are free to remove them from your website.

Regards,
Drazen