blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-38974 November 18, 2022
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin Full details
MEDIUM 4.3
CVE-2022-38075 November 18, 2022
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin Full details
MEDIUM 6.1
CVE-2022-45375 November 17, 2022
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in iFeature Slider plugin Full details
MEDIUM 5.4
CVE-2022-45069 November 17, 2022
Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin Full details
HIGH 8.8
CVE-2022-45066 November 17, 2022
Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin Full details
HIGH 8.8
CVE-2022-44736 November 17, 2022
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin Full details
MEDIUM 4.8
CVE-2022-44591 November 17, 2022
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anthologize plugin Full details
MEDIUM 4.8
CVE-2022-41132 November 17, 2022
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin Full details
MEDIUM 6.1
CVE-2022-40694 November 17, 2022
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin Full details
MEDIUM 4.8
CVE-2022-40200 November 17, 2022
Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin Full details
HIGH 8.8
CVE-2021-36905 November 17, 2022
Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin Full details
MEDIUM 5.4
CVE-2022-45072 November 17, 2022
Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin Full details
MEDIUM 4.3
CVE-2022-45071 November 17, 2022
Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin Full details
HIGH 8.8
CVE-2022-38461 November 17, 2022
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin Full details
MEDIUM 4.3
CVE-2022-4022 November 16, 2022
The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malicious javascript are not sanitized. While version 2.5 adds the ability to sanitize image as they… Full details
MEDIUM 5.4
CVE-2022-4021 November 16, 2022
The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This is due to missing or incorrect nonce validation on the extra_actions function. This… Full details
MEDIUM 4.3
CVE-2022-3240 November 15, 2022
The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing nonce validation on the FollowMeIgniteSocialMedia_options_page() function. This makes it… Full details
HIGH 8.8
CVE-2022-3632 November 14, 2022
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions. Full details
MEDIUM 6.5
CVE-2022-3631 November 14, 2022
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2022-3578 November 14, 2022
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-3574 November 14, 2022
The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection. Full details
CRITICAL 9.8
CVE-2022-3539 November 14, 2022
The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2022-3538 November 14, 2022
The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins Full details
MEDIUM 6.5
CVE-2022-3484 November 14, 2022
The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Full details
MEDIUM 6.1
CVE-2022-3477 November 14, 2022
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login… Full details
CRITICAL 9.8
CVE-2022-3469 November 14, 2022
The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2022-3415 November 14, 2022
The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin… Full details
MEDIUM 6.1
CVE-2022-2450 November 14, 2022
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them. Full details
MEDIUM 4.3
CVE-2022-2449 November 14, 2022
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users… Full details
MEDIUM 6.5
CVE-2022-42460 November 10, 2022
Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin Full details
MEDIUM 5.4
CVE-2022-44590 November 9, 2022
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in James Lao's Simple Video Embedder plugin Full details
MEDIUM 5.4
CVE-2022-43488 November 9, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin Full details
MEDIUM 4.3
CVE-2022-41978 November 9, 2022
Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin Full details
MEDIUM 6.5
CVE-2022-44741 November 8, 2022
Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin Full details
HIGH 8.8
CVE-2022-43491 November 8, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin Full details
MEDIUM 4.3
CVE-2022-43481 November 8, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin Full details
MEDIUM 4.3
CVE-2022-42494 November 8, 2022
Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin Full details
MEDIUM 6.5
CVE-2022-41980 November 8, 2022
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mantenimiento web plugin Full details
MEDIUM 4.8
CVE-2022-41136 November 8, 2022
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin Full details
HIGH 8.8
CVE-2022-40632 November 8, 2022
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin Full details
MEDIUM 5.4
CVE-2022-40223 November 8, 2022
Nonce token leakage and missing authorization in SearchWP premium plugin Full details
MEDIUM 4.3
CVE-2022-40206 November 8, 2022
Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin Full details
MEDIUM 4.3
CVE-2022-40205 November 8, 2022
Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin Full details
MEDIUM 4.3
CVE-2022-40128 November 8, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin Full details
MEDIUM 6.5
CVE-2022-32776 November 8, 2022
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Advanced Ads GmbH Advanced Ads – Ad Manager & AdSense plugin Full details
MEDIUM 4.8