blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-3720 November 21, 2022
The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users Full details
HIGH 7.2
CVE-2022-3691 November 21, 2022
The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an external, unauthenticated visitor. Full details
HIGH 7.5
CVE-2022-3690 November 21, 2022
The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks,… Full details
MEDIUM 4.8
CVE-2022-3688 November 21, 2022
The WPQA Builder WordPress plugin before 5.9 does not have CSRF check when following and unfollowing users, which could allow attackers to make logged in users perform such actions via CSRF attacks Full details
HIGH 8.8
CVE-2022-3634 November 21, 2022
The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection Full details
CRITICAL 9.8
CVE-2022-3618 November 21, 2022
The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability… Full details
MEDIUM 4.8
CVE-2022-3600 November 21, 2022
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection. Full details
CRITICAL 9.8
CVE-2022-3336 November 21, 2022
The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack Full details
MEDIUM 4.3
CVE-2022-1581 November 21, 2022
The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations. Full details
MEDIUM 5.3
CVE-2022-1578 November 21, 2022
The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack Full details
HIGH 8.8
CVE-2022-0421 November 21, 2022
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore,… Full details
MEDIUM 6.1
CVE-2021-24649 November 21, 2022
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This… Full details
CRITICAL 9.8
CVE-2022-41609 November 19, 2022
Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress. Full details
HIGH 8.8
CVE-2022-45369 November 18, 2022
Auth. (subscriber+) Broken Access Control vulnerability in Plugin for Google Reviews plugin Full details
MEDIUM 4.3
CVE-2022-45082 November 18, 2022
Multiple Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabilities in Accordions plugin Full details
MEDIUM 4.8
CVE-2022-45073 November 18, 2022
Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin Full details
HIGH 8.8
CVE-2022-44740 November 18, 2022
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin Full details
HIGH 8.8
CVE-2022-44634 November 18, 2022
Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin Full details
MEDIUM 4.9
CVE-2022-43492 November 18, 2022
Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress. Full details
HIGH 8.8
CVE-2022-42883 November 18, 2022
Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin Full details
HIGH 7.5
CVE-2022-42698 November 18, 2022
Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin Full details
CRITICAL 9.8
CVE-2022-42497 November 18, 2022
Arbitrary Code Execution vulnerability in Api2Cart Bridge Connector plugin Full details
CRITICAL 9.8
CVE-2022-42459 November 18, 2022
Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin Full details
HIGH 7.2
CVE-2022-41788 November 18, 2022
Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme Full details
MEDIUM 5.4
CVE-2022-41685 November 18, 2022
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin Full details
HIGH 8.8
CVE-2022-41655 November 18, 2022
Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin Full details
MEDIUM 6.5
CVE-2022-41643 November 18, 2022
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin Full details
MEDIUM 4.8
CVE-2022-41634 November 18, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin Full details
HIGH 8.8
CVE-2022-41618 November 18, 2022
Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin Full details
MEDIUM 5.3
CVE-2022-41615 November 18, 2022
Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin Full details
MEDIUM 6.1
CVE-2022-40963 November 18, 2022
Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin Full details
MEDIUM 5.4
CVE-2022-40698 November 18, 2022
Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin Full details
MEDIUM 6.1
CVE-2022-40695 November 18, 2022
Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin Full details
HIGH 8.8
CVE-2022-40216 November 18, 2022
Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin Full details
MEDIUM 6.5
CVE-2022-43482 November 18, 2022
Missing Authorization vulnerability in Appointment Booking Calendar plugin Full details
HIGH 8.8
CVE-2022-42461 November 18, 2022
Broken Access Control vulnerability in miniOrange's Google Authenticator plugin Full details
HIGH 8.8
CVE-2022-43463 November 18, 2022
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin Full details
MEDIUM 4.8
CVE-2022-41840 November 18, 2022
Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin Full details
CRITICAL 9.8
CVE-2022-41805 November 18, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin Full details
MEDIUM 4.3