blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-32587 November 8, 2022
Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin Full details
MEDIUM 4.3
CVE-2022-30545 November 8, 2022
Auth. Reflected Cross-Site Scripting (XSS) vulnerability in 5 Anker Connect plugin Full details
MEDIUM 4.8
CVE-2022-27855 November 8, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin Full details
MEDIUM 4.3
CVE-2022-3558 November 7, 2022
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. Full details
HIGH 8
CVE-2022-3537 November 7, 2022
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload… Full details
HIGH 8.8
CVE-2022-3536 November 7, 2022
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like… Full details
HIGH 8.8
CVE-2022-3494 November 7, 2022
The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or… Full details
HIGH 8.8
CVE-2022-3489 November 7, 2022
The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauthenticated attackers to update it with a crafted request Full details
MEDIUM 5.3
CVE-2022-3481 November 7, 2022
The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL… Full details
CRITICAL 9.8
CVE-2022-3463 November 7, 2022
The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection Full details
CRITICAL 9.8
CVE-2022-3462 November 7, 2022
The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… Full details
MEDIUM 4.8
CVE-2022-3451 November 7, 2022
The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action… Full details
MEDIUM 4.3
CVE-2022-3418 November 7, 2022
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress… Full details
HIGH 7.2
CVE-2022-2711 November 7, 2022
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary… Full details
HIGH 7.2
CVE-2022-2387 November 7, 2022
The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history.… Full details
MEDIUM 4.3
CVE-2022-44628 November 3, 2022
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin Full details
MEDIUM 4.8
CVE-2022-44627 November 3, 2022
Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin Full details
MEDIUM 5.4
CVE-2022-40131 November 3, 2022
Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin Full details
MEDIUM 4.3
CVE-2022-36428 November 3, 2022
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin Full details
MEDIUM 4.8
CVE-2022-25952 November 3, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin Full details
HIGH 8.8
CVE-2021-36906 November 3, 2022
Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin Full details
HIGH 8.8
CVE-2022-3852 November 3, 2022
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it… Full details
MEDIUM 6.5
CVE-2022-3776 November 3, 2022
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce… Full details
HIGH 8.8
CVE-2022-2696 November 3, 2022
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX actions in versions up to, and including 2.3.0 due to missing capability checks… Full details
MEDIUM 6.5
CVE-2022-44586 November 2, 2022
Auth. (admin+) Stored Cross-Site Scripting (XSS) in Ayoub Media AM-HiLi plugin Full details
MEDIUM 4.8
CVE-2022-44576 November 2, 2022
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in AgentEasy Properties plugin Full details
MEDIUM 4.8
CVE-2022-3441 October 31, 2022
The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… Full details
MEDIUM 4.8
CVE-2022-3440 October 31, 2022
The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected… Full details
MEDIUM 6.1
CVE-2022-3420 October 31, 2022
The Official Integration for Billingo WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users with a role as low as Shop Manager to perform… Full details
MEDIUM 4.8
CVE-2022-3419 October 31, 2022
The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator Full details
MEDIUM 6.5
CVE-2022-3408 October 31, 2022
The WP Word Count WordPress plugin through 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html… Full details
MEDIUM 4.8
CVE-2022-3380 October 31, 2022
The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when an admin imports (intentionally or not) a malicious file and a… Full details
HIGH 7.2
CVE-2022-3374 October 31, 2022
The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer… Full details
HIGH 7.2
CVE-2022-3366 October 31, 2022
The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations.… Full details
HIGH 7.2
CVE-2022-3360 October 31, 2022
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote… Full details
HIGH 8.1
CVE-2022-3357 October 31, 2022
The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection issues when a user import (intentionally or not) a malicious file, and… Full details
HIGH 8.8
CVE-2022-3334 October 31, 2022
The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue when an admin import (intentionally or not) a malicious file and… Full details
HIGH 7.2
CVE-2022-3254 October 31, 2022
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a… Full details
CRITICAL 9.8
CVE-2022-3237 October 31, 2022
The WP Contact Slider WordPress plugin before 2.4.8 does not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-3096 October 31, 2022
The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allow users such as subscribers to perform Stored Cross-Site Scripting attacks against other… Full details
MEDIUM 5.4
CVE-2022-2627 October 31, 2022
The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting. Full details
MEDIUM 6.1
CVE-2022-2190 October 31, 2022
The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Full details
MEDIUM 6.1
CVE-2022-2167 October 31, 2022
The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-3708 October 28, 2022
The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy… Full details
HIGH 8.1
CVE-2022-3402 October 28, 2022
The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes… Full details
MEDIUM 6.1
CVE-2022-3401 October 28, 2022
The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combined with… Full details
HIGH 8.8
CVE-2021-36864 October 28, 2022
Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin Full details
MEDIUM 5.4
CVE-2022-3400 October 28, 2022
The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action in versions 1.0 to 1.5.3. This makes it possible for authenticated attackers with… Full details
MEDIUM 6.5