blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-2654 September 16, 2022
The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do… Full details
MEDIUM 6.1
CVE-2022-2635 September 16, 2022
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2022-2575 September 16, 2022
The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks… Full details
MEDIUM 4.8
CVE-2022-2351 September 16, 2022
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other… Full details
MEDIUM 4.8
CVE-2022-1194 September 16, 2022
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection… Full details
HIGH 8.8
CVE-2022-38139 September 13, 2022
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin Full details
HIGH 8.8
CVE-2022-38135 September 12, 2022
Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin Full details
MEDIUM 4.3
CVE-2022-40191 September 9, 2022
Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin Full details
MEDIUM 5.4
CVE-2022-38144 September 9, 2022
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin Full details
HIGH 8.8
CVE-2022-38093 September 9, 2022
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin Full details
HIGH 8.8
CVE-2022-38068 September 9, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin Full details
MEDIUM 4.8
CVE-2022-38067 September 9, 2022
Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin Full details
MEDIUM 5.3
CVE-2022-38059 September 9, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin Full details
HIGH 8
CVE-2022-38058 September 9, 2022
Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin Full details
MEDIUM 4.3
CVE-2022-37412 September 9, 2022
Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Galerio & Urda's Better Delete Revision plugin Full details
MEDIUM 4.8
CVE-2022-37411 September 9, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza's Captcha Code plugin Full details
HIGH 8.8
CVE-2022-37407 September 9, 2022
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in WPChill Gallery PhotoBlocks plugin Full details
MEDIUM 5.4
CVE-2022-37405 September 9, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin Full details
HIGH 8.8
CVE-2022-37404 September 9, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Salazar's add2fav plugin Full details
MEDIUM 4.8
CVE-2022-37403 September 9, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin Full details
MEDIUM 4.8
CVE-2022-37335 September 9, 2022
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in WHA's Word Search Puzzles game plugin Full details
MEDIUM 4.8
CVE-2022-36793 September 9, 2022
Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin Full details
CRITICAL 9.1
CVE-2022-36422 September 9, 2022
Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin Full details
LOW 3.1
CVE-2022-36376 September 9, 2022
Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin Full details
CRITICAL 9.8
CVE-2022-36356 September 9, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy / Thirty8 Digital Culture Object plugin Full details
MEDIUM 4.8
CVE-2022-35725 September 9, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin Full details
MEDIUM 4.8
CVE-2022-35275 September 9, 2022
Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin Full details
MEDIUM 4.8
CVE-2022-37344 September 6, 2022
Missing Access Control vulnerability in PHP Crafts Accommodation System plugin Full details
CRITICAL 9.8
CVE-2022-36427 September 6, 2022
Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin Full details
CRITICAL 9.8
CVE-2022-36387 September 6, 2022
Broken Access Control vulnerability in Alessio Caiazza's About Me plugin Full details
CRITICAL 9.8
CVE-2022-3026 September 6, 2022
The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a… Full details
HIGH 8.8
CVE-2022-34867 September 6, 2022
Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin Full details
MEDIUM 6.5
CVE-2022-34656 September 6, 2022
Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin Full details
MEDIUM 4.8
CVE-2022-33177 September 6, 2022
Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin Full details
MEDIUM 4.3
CVE-2022-2945 September 6, 2022
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.5.3 via the 'type' parameter found in the alm_get_layout() function. This makes… Full details
LOW 2.7
CVE-2022-2943 September 6, 2022
The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the alm_repeaters_export() function.… Full details
MEDIUM 4.9
CVE-2022-2941 September 6, 2022
The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not… Full details
MEDIUM 4.8
CVE-2022-2939 September 6, 2022
The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possible. This is due to improper validation on the value… Full details
MEDIUM 5.3
CVE-2022-2936 September 6, 2022
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Video Link values that can be added to an Image Hover in versions up to, and including, 9.7.3 due… Full details
MEDIUM 5.4
CVE-2022-2935 September 6, 2022
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media Image URL value that can be added to an Image Hover in versions up to, and including,… Full details
MEDIUM 5.4
CVE-2022-2934 September 6, 2022
The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Image URL' value found in the Media block in versions up to, and including, 2.5.5.2 due to… Full details
MEDIUM 5.4
CVE-2022-2718 September 6, 2022
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-page-extrafields page in versions up to, and including,… Full details
MEDIUM 4.9
CVE-2022-2717 September 6, 2022
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-events-form page in versions up to, and including,… Full details
MEDIUM 4.9
CVE-2022-2716 September 6, 2022
The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Editor' block in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output… Full details
MEDIUM 5.4
CVE-2022-2695 September 6, 2022
The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to images via the media uploader in versions up to, and including, 2.5.5.2 due… Full details
MEDIUM 5.4
CVE-2022-2633 September 6, 2022
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0.… Full details
HIGH 8.2
CVE-2022-2542 September 6, 2022
The uContext for Clickbank plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This is due to missing nonce validation in the ~/app/sites/ajax/actions/keyword_save.php file… Full details
HIGH 8.8