blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-2541 September 6, 2022
The uContext for Amazon plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This is due to missing nonce validation in the ~/app/sites/ajax/actions/keyword_save.php file… Full details
HIGH 8.8
CVE-2022-2540 September 6, 2022
The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 1.4.5. This is due to missing nonce validation on the admin_page function… Full details
HIGH 8.8
CVE-2022-2518 September 6, 2022
The Stockists Manager for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.2.1. This is due to missing nonce validation on the stockist_settings_main() function. This makes… Full details
MEDIUM 6.1
CVE-2022-2517 September 6, 2022
The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Caption - On Hover' value associated with images in versions up to, and including, 2.5.5.2 due to… Full details
MEDIUM 5.4
CVE-2022-2516 September 6, 2022
The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page 'Title' value in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping.… Full details
MEDIUM 5.4
CVE-2022-2515 September 6, 2022
The Simple Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `pro_version_activation_code` parameter in versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it… Full details
MEDIUM 5.4
CVE-2022-2473 September 6, 2022
The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in versions up to, and including, 2.87.6 due to insufficient input sanitization and output escaping. This makes it possible… Full details
MEDIUM 4.8
CVE-2022-2462 September 6, 2022
The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX… Full details
MEDIUM 5.3
CVE-2022-2461 September 6, 2022
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX… Full details
MEDIUM 5.3
CVE-2022-2442 September 6, 2022
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers… Full details
HIGH 7.2
CVE-2022-2438 September 6, 2022
The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative… Full details
HIGH 7.2
CVE-2022-2436 September 6, 2022
The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and including 3.2.49. This makes it possible for authenticated attackers with contributor privileges… Full details
HIGH 8.8
CVE-2022-2434 September 6, 2022
The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0. This makes it possible for unauthenticated users to call files… Full details
HIGH 8.8
CVE-2022-2433 September 6, 2022
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' parameter in versions up to, and including 5.5.3. This makes it possible for… Full details
HIGH 7.5
CVE-2022-2432 September 6, 2022
The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23. This is due to missing or incorrect nonce validation on the ecwid_update_plugin_params function.… Full details
MEDIUM 4.3
CVE-2022-2431 September 6, 2022
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found… Full details
HIGH 8.8
CVE-2022-2430 September 6, 2022
The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping.… Full details
MEDIUM 5.4
CVE-2022-2429 September 6, 2022
The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such… Full details
HIGH 8
CVE-2022-2233 September 6, 2022
The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the pabc_admin_slides_postback() function found in the ~/admin/admin.php… Full details
HIGH 8.8
CVE-2022-1628 September 6, 2022
The Simple SEO plugin for WordPress is vulnerable to attribute-based stored Cross-Site Scripting in versions up to, and including 1.7.91, due to insufficient sanitization or escaping on the SEO social and standard title parameters.… Full details
MEDIUM 5.4
CVE-2021-36829 September 6, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop Launcher: Coming Soon & Maintenance Mode plugin Full details
MEDIUM 4.8
CVE-2022-2775 September 5, 2022
The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… Full details
MEDIUM 5.5
CVE-2022-2657 September 5, 2022
The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors… Full details
MEDIUM 4.3
CVE-2022-2597 September 5, 2022
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to… Full details
MEDIUM 5.4
CVE-2022-2565 September 5, 2022
The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins Full details
HIGH 7.2
CVE-2022-2543 September 5, 2022
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS… Full details
MEDIUM 6.1
CVE-2022-2376 September 5, 2022
The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users Full details
MEDIUM 5.3
CVE-2022-2271 September 5, 2022
The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability… Full details
MEDIUM 4.8
CVE-2022-2083 September 5, 2022
The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorized access to the site. Full details
HIGH 7.5
CVE-2022-36796 September 1, 2022
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking plugin Full details
MEDIUM 6.1
CVE-2022-36373 September 1, 2022
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin Full details
HIGH 8.8
CVE-2022-36355 September 1, 2022
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Easy Org Chart plugin Full details
MEDIUM 5.4
CVE-2022-2638 August 29, 2022
The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high… Full details
MEDIUM 6.5
CVE-2022-2599 August 29, 2022
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2559 August 29, 2022
The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users Full details
HIGH 7.2
CVE-2022-2556 August 29, 2022
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of… Full details
LOW 2.7
CVE-2022-2538 August 29, 2022
The WP Hide & Security Enhancer WordPress plugin before 1.8 does not escape a parameter before outputting it back in an attribute of a backend page, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2537 August 29, 2022
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting. Full details
MEDIUM 6.1
CVE-2022-2374 August 29, 2022
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2022-2373 August 29, 2022
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address Full details
MEDIUM 5.3
CVE-2022-2267 August 29, 2022
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal… Full details
MEDIUM 4.3
CVE-2022-2261 August 29, 2022
The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue. Full details
HIGH 7.2
CVE-2022-2080 August 29, 2022
The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary… Full details
MEDIUM 4.3
CVE-2022-2034 August 29, 2022
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers Full details
MEDIUM 5.3
CVE-2022-1663 August 29, 2022
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to… Full details
MEDIUM 6.5
CVE-2022-1123 August 29, 2022
The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL… Full details
HIGH 7.2
CVE-2022-36405 August 23, 2022
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in amCharts: Charts and Maps plugin Full details
MEDIUM 5.4
CVE-2022-36394 August 23, 2022
Authenticated (author+) SQL Injection (SQLi) vulnerability in Contest Gallery plugin Full details
HIGH 8.8
CVE-2022-36389 August 23, 2022
Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin Full details
HIGH 8.8