blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,580
Affected records46,283
Newest source updateNovember 8, 2026
CVE-2026-97195 November 8, 2026
The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user able to configure its fields to… Full details
LOW 3.5
CVE-2026-97194 November 8, 2026
The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to… Full details
LOW 2.7
CVE-2026-97193 November 8, 2026
The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access… Full details
LOW 2.7
CVE-2026-97192 November 8, 2026
The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write… Full details
LOW 2.7
CVE-2026-96963 November 8, 2026
The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records. Full details
LOW 2.7
CVE-2026-96961 November 8, 2026
The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated attackers to reset the Pie Register WordPress plugin through 3.8.4.15's… Full details
MEDIUM 6.5
CVE-2026-85344 November 8, 2026
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger… Full details
MEDIUM 4.3
CVE-2026-122085 November 8, 2026
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is available to unauthenticated users, allowing them to transfer other… Full details
MEDIUM 6.5
CVE-2026-122062 November 8, 2026
The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the… Full details
MEDIUM 5.3
CVE-2026-122060 November 8, 2026
The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output,… Full details
MEDIUM 5.3
CVE-2026-114432 November 8, 2026
The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file… Full details
CRITICAL 9.8
CVE-2026-110963 November 8, 2026
The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator… Full details
CRITICAL 9.8
CVE-2026-110132 November 8, 2026
The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify… Full details
MEDIUM 4.9
CVE-2026-109925 November 8, 2026
The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. Full details
HIGH 8.6
CVE-2026-106015 November 8, 2026
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators. Full details
HIGH 8.1
CVE-2026-105970 November 8, 2026
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary… Full details
MEDIUM 5.3
CVE-2026-104639 November 8, 2026
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the… Full details
MEDIUM 4.1
CVE-2026-104338 November 8, 2026
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated… Full details
LOW 3.7
CVE-2026-104337 November 8, 2026
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary… Full details
MEDIUM 5.3
CVE-2026-103375 November 8, 2026
The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirmation link, which contains its secret key, to unauthenticated visitors, allowing attackers to view any… Full details
MEDIUM 5.3
CVE-2026-103303 November 8, 2026
The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin… Full details
HIGH 8.8
CVE-2026-120531 November 7, 2026
The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data[ip]’ parameter in all versions up to, and including, 10.47 due to insufficient input sanitization… Full details
HIGH 7.2
CVE-2026-123472 November 7, 2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Stored XSS.This issue affects Meta Box – WordPress Custom Fields Framework: from… Full details
MEDIUM 6.5
CVE-2026-120836 November 7, 2026
Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3. Full details
MEDIUM 6.5
CVE-2026-123474 November 7, 2026
Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18. Full details
MEDIUM 5.3
CVE-2026-122041 November 7, 2026
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including,… Full details
CRITICAL 9.1
CVE-2026-120579 November 7, 2026
The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'help_title' parameter in all versions up to, and including, 2.1.5 due to insufficient input… Full details
MEDIUM 6.4
CVE-2026-119156 November 7, 2026
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_reg[first_name], wpdm_reg[last_name], wpdm_reg[user_login]' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping.… Full details
HIGH 7.2
CVE-2026-109973 November 7, 2026
The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1.… Full details
MEDIUM 6.4
CVE-2026-96565 November 7, 2026
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input… Full details
MEDIUM 6.4
CVE-2026-93766 November 7, 2026
The Happyforms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'happyforms_client_referer' parameter in all versions up to, and including, 1.38.9 due to insufficient input sanitization and output escaping. This makes… Full details
HIGH 7.2
CVE-2026-93755 November 7, 2026
The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in versions up to, and including, 1.38.9. This is due to the happyforms_get_client_ip() function reading raw HTTP_CLIENT_IP and… Full details
HIGH 7.2
CVE-2026-93429 November 7, 2026
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guests[][][documents]' Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output… Full details
HIGH 7.2
CVE-2026-123418 November 7, 2026
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes… Full details
HIGH 7.2
CVE-2026-122231 November 7, 2026
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field_[0][0]' parameter in all versions up to, and including, 1.12.18 due to… Full details
HIGH 7.2
CVE-2026-122059 November 7, 2026
The WP ImageViewer plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img.alt' parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This… Full details
MEDIUM 6.4
CVE-2026-121977 November 7, 2026
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note (form field whose value is written to post meta `note`)' parameter in all versions up… Full details
MEDIUM 5.4
CVE-2026-121976 November 7, 2026
The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field… Full details
MEDIUM 6.4
CVE-2026-120685 November 7, 2026
The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_image (JPEG IPTC caption) + tpro_client_testimonial ([gallery] shortcode)' parameter in all… Full details
MEDIUM 5.4
CVE-2026-120683 November 7, 2026
The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_testimonial' parameter in all versions up to, and including, 4.1.0 due… Full details
MEDIUM 5.4
CVE-2026-120509 November 7, 2026
The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_name' parameter in all versions up to, and including, 4.1.0 due… Full details
MEDIUM 4.7
CVE-2026-119183 November 7, 2026
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and… Full details
HIGH 7.2
CVE-2026-119075 November 7, 2026
The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration… Full details
CRITICAL 9.8
CVE-2026-118267 November 7, 2026
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89… Full details
HIGH 8.1
CVE-2026-118066 November 7, 2026
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due… Full details
CRITICAL 9.1
CVE-2026-118056 November 7, 2026
The Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rawdata.oxi_image_comparison_before_text' parameter in all versions up to, and including,… Full details
MEDIUM 4.9
CVE-2026-118050 November 7, 2026
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shouttext' parameter in all versions up to, and including, 2.13.5 due to insufficient input sanitization and output escaping. This makes… Full details
MEDIUM 6.4
CVE-2026-118047 November 7, 2026
The Falang multilanguage for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'falang_term[][][] (via order[] driving wp_update_term)' parameter in all versions up to, and including, 1.4.6 due to insufficient input… Full details
MEDIUM 6.4
CVE-2026-116751 November 7, 2026
The Booking for Appointments and Events Calendar – Amelia Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'tag[] (array KEYS)' parameter in all versions up to, and including, 9.9.1 due… Full details
HIGH 7.5
CVE-2026-116537 November 7, 2026
The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_description' parameter in all versions up to, and including, 7.10.0 due to insufficient input sanitization and output escaping. This makes… Full details
HIGH 7.2