blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-4395 January 30, 2023
The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE. Full details
CRITICAL 9.8
CVE-2022-4306 January 30, 2023
The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against… Full details
MEDIUM 5.4
CVE-2023-0581 January 30, 2023
The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if… Full details
MEDIUM 5.3
CVE-2023-0558 January 27, 2023
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for… Full details
CRITICAL 9.8
CVE-2023-0557 January 27, 2023
The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts. Full details
MEDIUM 5.3
CVE-2023-0556 January 27, 2023
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to… Full details
MEDIUM 6.5
CVE-2023-0555 January 27, 2023
The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.0.2. This makes it possible for… Full details
HIGH 8.1
CVE-2023-0554 January 27, 2023
The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This… Full details
HIGH 8.1
CVE-2023-0553 January 27, 2023
The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes… Full details
MEDIUM 4.4
CVE-2023-0550 January 27, 2023
The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin… Full details
HIGH 8.1
CVE-2023-0448 January 26, 2023
The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability. Full details
MEDIUM 6.1
CVE-2022-47615 January 26, 2023
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin Full details
CRITICAL 9.8
CVE-2022-45820 January 26, 2023
SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin Full details
HIGH 8.8
CVE-2023-22721 January 23, 2023
Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps for WordPress  Full details
MEDIUM 5.4
CVE-2023-0447 January 23, 2023
The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache function in versions up to, and including, 3.0.12.1. This makes it possible for… Full details
MEDIUM 4.3
CVE-2023-0446 January 23, 2023
The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes… Full details
MEDIUM 5.5
CVE-2022-4832 January 23, 2023
The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details
MEDIUM 5.4
CVE-2022-4790 January 23, 2023
The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform… Full details
MEDIUM 5.4
CVE-2022-4789 January 23, 2023
The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Full details
MEDIUM 5.4
CVE-2022-4775 January 23, 2023
The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor… Full details
MEDIUM 5.4
CVE-2022-4760 January 23, 2023
The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as… Full details
MEDIUM 5.4
CVE-2022-4758 January 23, 2023
The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor… Full details
MEDIUM 5.4
CVE-2022-4753 January 23, 2023
The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor… Full details
MEDIUM 5.4
CVE-2022-4751 January 23, 2023
The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details
MEDIUM 5.4
CVE-2022-4746 January 23, 2023
The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin. Full details
HIGH 7.5
CVE-2022-4718 January 23, 2023
The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low… Full details
MEDIUM 5.4
CVE-2022-4716 January 23, 2023
The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details
MEDIUM 5.4
CVE-2022-4715 January 23, 2023
The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details
MEDIUM 5.4
CVE-2022-4706 January 23, 2023
The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low… Full details
MEDIUM 5.4
CVE-2022-4693 January 23, 2023
The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user’s username. Depending on whose username we know, which can… Full details
CRITICAL 9.8
CVE-2022-4675 January 23, 2023
The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting… Full details
MEDIUM 5.4
CVE-2022-4673 January 23, 2023
The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting… Full details
MEDIUM 5.4
CVE-2022-4672 January 23, 2023
The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as… Full details
MEDIUM 5.4
CVE-2022-4668 January 23, 2023
The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details
MEDIUM 5.4
CVE-2022-4650 January 23, 2023
The HashBar WordPress plugin before 1.3.6 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Full details
MEDIUM 5.4
CVE-2022-4629 January 23, 2023
The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as… Full details
MEDIUM 5.4
CVE-2022-4627 January 23, 2023
The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor… Full details
MEDIUM 5.4
CVE-2022-4625 January 23, 2023
The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low… Full details
MEDIUM 5.4
CVE-2022-4624 January 23, 2023
The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low… Full details
MEDIUM 5.4
CVE-2022-4576 January 23, 2023
The Easy Bootstrap Shortcode WordPress plugin through 4.5.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low… Full details
MEDIUM 5.4
CVE-2022-4570 January 23, 2023
The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, which could allow users with a role as low as… Full details
MEDIUM 5.4
CVE-2022-4548 January 23, 2023
The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in… Full details
MEDIUM 6.5
CVE-2022-4545 January 23, 2023
The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor… Full details
MEDIUM 5.4
CVE-2022-4542 January 23, 2023
The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as… Full details
MEDIUM 5.4
CVE-2022-4509 January 23, 2023
The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details
MEDIUM 5.4
CVE-2022-4485 January 23, 2023
The Page-list WordPress plugin before 5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor… Full details
MEDIUM 5.4
CVE-2022-4475 January 23, 2023
The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor… Full details
MEDIUM 5.4
CVE-2022-4474 January 23, 2023
The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low… Full details
MEDIUM 5.4
CVE-2022-4467 January 23, 2023
The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low… Full details
MEDIUM 5.4