blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-40195 September 23, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin Full details
MEDIUM 4.8
CVE-2022-40193 September 23, 2022
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin Full details
MEDIUM 6.1
CVE-2022-38460 September 23, 2022
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin Full details
MEDIUM 5.4
CVE-2022-38085 September 23, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin Full details
HIGH 8.8
CVE-2022-38061 September 23, 2022
Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin Full details
MEDIUM 5.7
CVE-2022-37342 September 23, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin Full details
MEDIUM 4.8
CVE-2022-37328 September 23, 2022
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin Full details
MEDIUM 5.4
CVE-2022-36791 September 23, 2022
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin Full details
MEDIUM 5.4
CVE-2022-36388 September 23, 2022
Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin Full details
HIGH 8.8
CVE-2022-35238 September 23, 2022
Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin Full details
MEDIUM 5.3
CVE-2022-40213 September 23, 2022
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin Full details
MEDIUM 5.4
CVE-2022-3144 September 23, 2022
The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient… Full details
MEDIUM 4.8
CVE-2022-38703 September 23, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin Full details
MEDIUM 4.8
CVE-2022-38095 September 23, 2022
Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin Full details
MEDIUM 4.3
CVE-2022-37339 September 23, 2022
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin Full details
MEDIUM 5.4
CVE-2022-37338 September 23, 2022
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin Full details
MEDIUM 5.4
CVE-2022-37330 September 23, 2022
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA Crossword plugin Full details
MEDIUM 5.4
CVE-2022-36798 September 23, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin Full details
HIGH 8.8
CVE-2022-2937 September 23, 2022
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that can be added to an Image Hover in versions up to, and including,… Full details
MEDIUM 5.4
CVE-2022-40217 September 21, 2022
Authenticated (admin+) Arbitrary File Edit/Upload vulnerability in XplodedThemes WPide plugin Full details
HIGH 7.2
CVE-2022-38073 September 21, 2022
Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin Full details
MEDIUM 5.4
CVE-2022-36390 September 21, 2022
Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin Full details
MEDIUM 5.4
CVE-2022-36386 September 21, 2022
Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin Full details
HIGH 7.2
CVE-2022-36383 September 21, 2022
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Word Search Puzzles game plugin Full details
MEDIUM 5.4
CVE-2022-36365 September 21, 2022
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Crossword plugin Full details
MEDIUM 5.4
CVE-2022-40219 September 21, 2022
Cross-Site Request Forgery (CSRF) vulnerability in SedLex FavIcon Switcher plugin Full details
MEDIUM 4.3
CVE-2022-3142 September 19, 2022
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted… Full details
HIGH 8.8
CVE-2022-3141 September 19, 2022
The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query… Full details
HIGH 8.8
CVE-2022-3036 September 19, 2022
The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2022-3021 September 19, 2022
The Slickr Flickr WordPress plugin through 2.8.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-2958 September 19, 2022
The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections Full details
HIGH 8.8
CVE-2022-2840 September 19, 2022
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to… Full details
CRITICAL 9.8
CVE-2022-2754 September 19, 2022
The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using them in SQL statements, which could allow unauthenticated attackers to perform SQL Injection attacks Full details
CRITICAL 9.8
CVE-2022-2753 September 19, 2022
The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation… Full details
MEDIUM 6.1
CVE-2022-2710 September 19, 2022
The Scroll To Top WordPress plugin before 1.4.1 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2022-2709 September 19, 2022
The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… Full details
MEDIUM 4.8
CVE-2022-2567 September 19, 2022
The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even… Full details
MEDIUM 4.8
CVE-2022-1591 September 19, 2022
The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF… Full details
MEDIUM 4.3
CVE-2022-1580 September 19, 2022
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to… Full details
MEDIUM 4.3
CVE-2022-29489 September 16, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Sucuri Security plugin Full details
MEDIUM 4.3
CVE-2022-2913 September 16, 2022
The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login… Full details
MEDIUM 4.3
CVE-2022-2912 September 16, 2022
The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change the url value performing unwanted crawls on third-party sites (SSRF). Full details
MEDIUM 4.3
CVE-2022-2887 September 16, 2022
The WP Server Health Stats WordPress plugin before 1.7.0 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-2877 September 16, 2022
The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the… Full details
MEDIUM 5.3
CVE-2022-2863 September 16, 2022
The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from… Full details
MEDIUM 4.9
CVE-2022-2799 September 16, 2022
The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-2798 September 16, 2022
The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data Full details
HIGH 8
CVE-2022-2737 September 16, 2022
The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… Full details
MEDIUM 4.8
CVE-2022-2669 September 16, 2022
The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2655 September 16, 2022
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1