If your website runs WordPress, there’s another recent security story worth paying attention to.
On July 28, security researchers at Wordfence identified malicious code that had been intentionally added to Advanced Responsive Video Embedder, a WordPress plugin with roughly 20,000 active installations. Unlike a typical software bug, this was what security professionals call a supply-chain attack—someone managed to introduce malicious code into a legitimate plugin update before it reached users.
Wordfence detected the issue within two hours, notified the WordPress.org plugin team immediately, and the plugin was removed from the official repository before it was widely distributed. According to Wordfence, websites that automatically installed the compromised version were expected to be very limited, but anyone using the plugin should verify their installation and remove the affected release if necessary.
Why this matters
The good news is that this incident appears to have been caught quickly.
The bigger takeaway is that maintaining a WordPress website involves more than simply updating WordPress itself. Plugins are third-party software, and every additional plugin becomes another component that needs to be monitored, updated, and occasionally replaced.
For most websites, that isn’t something to panic about—but it is something to take seriously.
What should small business owners do?
If your website uses the Advanced Responsive Video Embedder plugin, remove the affected version immediately and review your website for any unexpected administrator accounts or other changes, following Wordfence’s guidance.
Even if you don’t use this particular plugin, it’s a good reminder to:
- Keep WordPress, plugins, and themes up to date.
- Remove plugins you no longer use.
- Review administrator accounts periodically.
- Make sure your website is being maintained by someone you trust.
- Periodically review whether every installed plugin is still necessary.
Why I build custom websites
I’ve spent more than a decade building and supporting WordPress websites, and I still help clients maintain existing WordPress sites.
For many small businesses, though, this is exactly why I recommend custom-built websites for new projects whenever they’re a good fit.
A custom website doesn’t rely on dozens of third-party plugins to provide its core functionality. That means fewer moving parts, fewer compatibility concerns, fewer update cycles, and fewer opportunities for problems like this to arise.
WordPress remains a compelling platform for many organizations. But for many small business websites, it doesn’t offer meaningful advantages over a well-built custom website. In those cases, a custom-built site can often be faster, simpler, and easier to maintain over the long term. If you want to talk through whether that makes sense for your business, send me a note.