These plugins are installed on tens of thousands — sometimes millions — of sites, yet haven't shipped an update in over a year. An unmaintained plugin won't get security patches, and the bigger its install base, the more sites are exposed.
Data-mined from the 250 most popular plugins on WordPress.org. “Abandoned” here means no update in over 14 months; plugins flagged Critical haven't been touched in over three years. Snapshot from June 2026 — a plugin may be updated again at any time.
Running any of these? It doesn't always mean trouble, but it's worth a look — score it in full or read how to spot and replace an abandoned plugin .