blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-2823 October 10, 2022
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parameters, which could allow high privilege users such as admin to perform Stored… Full details
MEDIUM 4.8
CVE-2022-2629 October 10, 2022
The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which could allow high privilege users such as admin to perform Stored… Full details
MEDIUM 4.8
CVE-2022-2554 October 10, 2022
The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to… Full details
MEDIUM 4.9
CVE-2022-2448 October 10, 2022
The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfiltered_html is… Full details
MEDIUM 4.8
CVE-2022-2350 October 10, 2022
The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attackers to block (or unblock) users at will. Full details
MEDIUM 5.3
CVE-2021-25044 October 10, 2022
The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site… Full details
MEDIUM 6.1
CVE-2022-3132 October 3, 2022
The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-3128 October 3, 2022
The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… Full details
MEDIUM 4.8
CVE-2022-3125 October 3, 2022
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able… Full details
HIGH 8.8
CVE-2022-3124 October 3, 2022
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow… Full details
MEDIUM 5.3
CVE-2022-2839 October 3, 2022
The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks.… Full details
MEDIUM 5.4
CVE-2022-2763 October 3, 2022
The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2022-2628 October 3, 2022
The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting… Full details
MEDIUM 4.8
CVE-2021-36865 September 30, 2022
Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin Full details
MEDIUM 4.3
CVE-2021-36855 September 30, 2022
Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin Full details
MEDIUM 6.1
CVE-2021-36854 September 30, 2022
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin Full details
HIGH 8.8
CVE-2021-36839 September 30, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin Full details
MEDIUM 4.8
CVE-2021-36830 September 30, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin Full details
MEDIUM 4.8
CVE-2022-3135 September 26, 2022
The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2022-3119 September 26, 2022
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to… Full details
HIGH 7.5
CVE-2022-3098 September 26, 2022
The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF… Full details
MEDIUM 4.3
CVE-2022-3076 September 26, 2022
The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins… Full details
HIGH 7.2
CVE-2022-3074 September 26, 2022
The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks. Full details
MEDIUM 4.8
CVE-2022-3070 September 26, 2022
The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-3069 September 26, 2022
The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-3062 September 26, 2022
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-3025 September 26, 2022
The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make a logged in admin change them via a CSRF attack. Furthermore,… Full details
MEDIUM 5.4
CVE-2022-3024 September 26, 2022
The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due… Full details
MEDIUM 5.4
CVE-2022-2987 September 26, 2022
The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers… Full details
HIGH 7.5
CVE-2022-2926 September 26, 2022
The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the… Full details
MEDIUM 4.9
CVE-2022-2903 September 26, 2022
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file… Full details
HIGH 7.2
CVE-2022-2405 September 26, 2022
The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup Full details
MEDIUM 4.3
CVE-2022-2404 September 26, 2022
The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2352 September 26, 2022
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations… Full details
HIGH 7.2
CVE-2022-1755 September 26, 2022
The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks Full details
MEDIUM 5.4
CVE-2022-1613 September 26, 2022
The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations in certain situations. Full details
MEDIUM 5.3
CVE-2021-24890 September 26, 2022
The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any… Full details
HIGH 8.8
CVE-2022-40132 September 23, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin Full details
MEDIUM 4.3
CVE-2022-38704 September 23, 2022
Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin Full details
MEDIUM 4.3
CVE-2022-38454 September 23, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Kraken.io Image Optimizer plugin Full details
HIGH 8.8
CVE-2022-36340 September 23, 2022
Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin Full details
MEDIUM 5.3
CVE-2022-40215 September 23, 2022
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin Full details
MEDIUM 5.4
CVE-2022-40194 September 23, 2022
Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin Full details
HIGH 7.5
CVE-2022-38470 September 23, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin Full details
HIGH 8.8
CVE-2022-38134 September 23, 2022
Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin Full details
HIGH 8.8
CVE-2022-36417 September 23, 2022
Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin Full details
MEDIUM 6.1
CVE-2022-40672 September 23, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin Full details
MEDIUM 4.8
CVE-2022-40671 September 23, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Rate my Post – WP Rating System plugin Full details
MEDIUM 4.3
CVE-2022-40310 September 23, 2022
Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin Full details
LOW 3.1