blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-3880 December 12, 2022
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such… Full details
MEDIUM 6.5
CVE-2022-3879 December 12, 2022
The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it… Full details
MEDIUM 6.5
CVE-2022-3862 December 12, 2022
The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even… Full details
MEDIUM 4.8
CVE-2022-3609 December 12, 2022
The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability… Full details
MEDIUM 4.8
CVE-2022-3605 December 12, 2022
The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability. Full details
HIGH 7.8
CVE-2022-3359 December 12, 2022
The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object injection when a user imports (intentionally or not) a… Full details
HIGH 8.8
CVE-2022-43468 December 7, 2022
External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the… Full details
HIGH 7.5
CVE-2022-45816 December 6, 2022
Auth. Stored Cross-Site Scripting (XSS) vulnerability in GD bbPress Attachments plugin Full details
MEDIUM 5.4
CVE-2022-45848 December 6, 2022
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin Full details
MEDIUM 6.1
CVE-2022-45359 December 6, 2022
Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin Full details
CRITICAL 9.8
CVE-2022-40209 December 6, 2022
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin Full details
MEDIUM 6.1
CVE-2022-3926 December 5, 2022
The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client… Full details
MEDIUM 6.5
CVE-2022-3909 December 5, 2022
The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… Full details
MEDIUM 4.8
CVE-2022-3907 December 5, 2022
The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored… Full details
HIGH 7.5
CVE-2022-3892 December 5, 2022
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2022-3858 December 5, 2022
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement,… Full details
HIGH 7.2
CVE-2022-3856 December 5, 2022
The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role… Full details
HIGH 7.2
CVE-2022-3846 December 5, 2022
The Workreap WordPress theme before 2.6.3 has a vulnerability with the notifications feature as it's possible to read any user's notification (employer or freelancer) as the notification ID is brute-forceable. Full details
HIGH 7.5
CVE-2022-3838 December 5, 2022
The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2022-3837 December 5, 2022
The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… Full details
MEDIUM 4.8
CVE-2022-3830 December 5, 2022
The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2022-3694 December 5, 2022
The Syncee WordPress plugin before 1.0.10 leaks the administrator token that can be used to take over the administrator's account. Full details
HIGH 7.5
CVE-2022-3677 December 5, 2022
The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and activate… Full details
MEDIUM 6.5
CVE-2022-3426 December 5, 2022
The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2022-3249 December 5, 2022
The WP CSV Exporter WordPress plugin before 1.3.7 does not properly sanitise and escape some parameters before using them in a SQL statement, allowing high privilege users such as admin to perform SQL injection… Full details
HIGH 7.2
CVE-2022-1540 December 5, 2022
The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE. Full details
HIGH 7.2
CVE-2022-45822 December 5, 2022
Unauth. SQL Injection (SQLi) vulnerability in Advanced Booking Calendar plugin Full details
CRITICAL 9.8
CVE-2022-43504 December 5, 2022
Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The… Full details
MEDIUM 5.3
CVE-2022-43500 December 5, 2022
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. Full details
MEDIUM 6.1
CVE-2022-43497 December 5, 2022
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. Full details
MEDIUM 6.1
CVE-2022-40968 December 4, 2022
Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin Full details
MEDIUM 6.1
CVE-2022-35730 December 4, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin Full details
MEDIUM 6.5
CVE-2022-4220 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible… Full details
MEDIUM 4.3
CVE-2022-4219 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the manage() function. This makes it possible… Full details
MEDIUM 4.3
CVE-2022-4218 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_quizzes() function. This makes it possible… Full details
MEDIUM 4.3
CVE-2022-4217 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it… Full details
MEDIUM 4.8
CVE-2022-4216 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it… Full details
MEDIUM 4.8
CVE-2022-4215 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output… Full details
MEDIUM 6.1
CVE-2022-4214 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output… Full details
MEDIUM 6.1
CVE-2022-4213 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output… Full details
MEDIUM 6.1
CVE-2022-4212 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ipf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output… Full details
MEDIUM 6.1
CVE-2022-4211 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output… Full details
MEDIUM 6.1
CVE-2022-4210 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output… Full details
MEDIUM 6.1
CVE-2022-4209 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output… Full details
MEDIUM 6.1
CVE-2022-4208 December 2, 2022
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output… Full details
MEDIUM 6.1
CVE-2022-4036 November 29, 2022
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret… Full details
MEDIUM 5.3
CVE-2022-4035 November 29, 2022
The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping… Full details
MEDIUM 6.1