blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-36379 August 23, 2022
Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin Full details
HIGH 8.8
CVE-2022-36347 August 23, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin Full details
MEDIUM 5.4
CVE-2022-36341 August 23, 2022
Authenticated (subscriber+) plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability in Akash soni's AS – Create Pinterest Pinboard Pages plugin Full details
MEDIUM 5.4
CVE-2022-36292 August 23, 2022
Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin Full details
HIGH 8.8
CVE-2022-36288 August 23, 2022
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin Full details
HIGH 8.8
CVE-2022-36285 August 23, 2022
Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin Full details
HIGH 7.2
CVE-2022-36282 August 23, 2022
Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin Full details
MEDIUM 5.4
CVE-2022-35242 August 23, 2022
Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin Full details
MEDIUM 5.3
CVE-2022-35235 August 23, 2022
Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin Full details
MEDIUM 4.9
CVE-2022-34868 August 23, 2022
Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin Full details
MEDIUM 6.5
CVE-2022-34658 August 23, 2022
Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin Full details
MEDIUM 5.4
CVE-2022-34648 August 23, 2022
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin Full details
MEDIUM 5.4
CVE-2022-33142 August 23, 2022
Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin Full details
MEDIUM 6.5
CVE-2022-29476 August 23, 2022
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin Full details
MEDIUM 6.1
CVE-2022-36346 August 22, 2022
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin Full details
HIGH 8.8
CVE-2022-34858 August 22, 2022
Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin Full details
CRITICAL 9.8
CVE-2022-34857 August 22, 2022
Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin Full details
MEDIUM 6.1
CVE-2022-34347 August 22, 2022
Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin Full details
HIGH 8.8
CVE-2022-34149 August 22, 2022
Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin Full details
CRITICAL 9.8
CVE-2022-2600 August 22, 2022
The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener… Full details
MEDIUM 5.4
CVE-2022-2594 August 22, 2022
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if… Full details
HIGH 8.8
CVE-2022-2593 August 22, 2022
The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL query, which could allow high privilege users to perform SQL Injection attacks Full details
HIGH 7.2
CVE-2022-2558 August 22, 2022
The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configurations. Full details
MEDIUM 5.3
CVE-2022-2557 August 22, 2022
The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted… Full details
HIGH 8.8
CVE-2022-2555 August 22, 2022
The Yotpo Reviews for WooCommerce WordPress plugin through 2.0.4 lacks nonce check when updating its settings, which could allow attacker to make a logged in admin change them via a CSRF attack. Full details
MEDIUM 6.5
CVE-2022-2552 August 22, 2022
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site. Full details
MEDIUM 5.3
CVE-2022-2551 August 22, 2022
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an… Full details
HIGH 7.5
CVE-2022-2544 August 22, 2022
The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes. Full details
HIGH 7.5
CVE-2022-2532 August 22, 2022
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2407 August 22, 2022
The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is… Full details
MEDIUM 4.8
CVE-2022-2392 August 22, 2022
The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higher. Full details
MEDIUM 6.5
CVE-2022-2389 August 22, 2022
The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing… Full details
MEDIUM 4.3
CVE-2022-2388 August 22, 2022
The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones… Full details
MEDIUM 6.5
CVE-2022-2383 August 22, 2022
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2382 August 22, 2022
The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in… Full details
MEDIUM 4.3
CVE-2022-2377 August 22, 2022
The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog Full details
MEDIUM 4.3
CVE-2022-2375 August 22, 2022
The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some… Full details
MEDIUM 5.4
CVE-2022-2362 August 22, 2022
The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based download blocking restrictions. Full details
HIGH 7.5
CVE-2022-2361 August 22, 2022
The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Full details
MEDIUM 4.8
CVE-2022-2312 August 22, 2022
The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make logged in user with a role as low as contributor to add/edit… Full details
MEDIUM 5.4
CVE-2022-2276 August 22, 2022
The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete arbitrary posts/pages from the blog Full details
MEDIUM 4.3
CVE-2022-2275 August 22, 2022
The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin delete arbitrary posts/pages from the blog via a… Full details
MEDIUM 4.3
CVE-2022-2198 August 22, 2022
The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other… Full details
MEDIUM 4.3
CVE-2022-2172 August 22, 2022
The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change settings via a CSRF attack. Full details
MEDIUM 4.3
CVE-2022-25812 August 22, 2022
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE Full details
HIGH 7.2
CVE-2022-25811 August 22, 2022
The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection Full details
HIGH 7.2
CVE-2022-25810 August 22, 2022
The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities… Full details
MEDIUM 6.5
CVE-2022-1932 August 22, 2022
The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via… Full details
MEDIUM 6.1