Ona · Security record
Is Ona safe?
No known vulnerability affects the current version (1.29). 3 issues were found in earlier versions and fixed, the latest disclosed on May 1, 2026.
Checked 6 days ago against the WPVulnerability database, for version 1.29.
How it’s looked after
- Last release
- Sep 3, 2026 (2 months ago)
- Releases in the last year
- 7
- Active installs
- 2K+
3 known vulnerabilities
- 1 critical
- 1 high
- 1 medium
None affects the current version.
Disclosed each year
- 20231
- 20262
Every known vulnerability in Ona
Newest first, with any that affect the current version at the top.
- medium
Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter
Fixed in 1.27 · CVE-2026-6812 · May 1, 2026 · Wordfence
Fixed in 1.24 · CVE-2026-32482 · Mar 23, 2026 · Wordfence
Fixed in 1.18.3 · CVE-2023-33999 · Jul 18, 2023 · WPScan
Questions about Ona’s security
Is Ona safe to use?
No known vulnerability affects its current version. Earlier versions had issues that are now fixed, so keep Ona updated: most attacks target sites that haven’t updated.
Does Ona have known security vulnerabilities?
None that affect the current version. WPVulnerability’s database lists 3 older issues, fixed in earlier versions, so keep Ona up to date.
Is Ona still maintained?
Yes. Its last release was 2 months ago.
Hear about the next one first
Track your theme on TrackWP and get an alert when a new vulnerability affecting it is published. Every plan has it, the free Starter too; Boost and FullCharge email it at once.
Start freeVulnerability data from WPVulnerability (CC0), which gathers records from CVE, Wordfence, Patchstack and WPScan. A clean record isn’t a guarantee: keep every theme updated.