blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-1322 August 22, 2022
The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Full details
MEDIUM 4.8
CVE-2022-1251 August 22, 2022
The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a user to change their profile information by… Full details
MEDIUM 4.3
CVE-2022-0446 August 22, 2022
The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2021-36857 August 22, 2022
Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin Full details
MEDIUM 5.4
CVE-2021-36852 August 22, 2022
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin Full details
HIGH 8
CVE-2021-36847 August 22, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin Full details
MEDIUM 4.8
CVE-2021-24912 August 22, 2022
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation… Full details
MEDIUM 5.4
CVE-2021-24911 August 22, 2022
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of… Full details
MEDIUM 5.4
CVE-2021-24910 August 22, 2022
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before… Full details
MEDIUM 6.1
CVE-2022-2846 August 16, 2022
The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some… Full details
MEDIUM 4.3
CVE-2022-2535 August 15, 2022
The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending… Full details
MEDIUM 5.3
CVE-2022-2384 August 15, 2022
The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is… Full details
MEDIUM 4.8
CVE-2022-2381 August 15, 2022
The E Unlocked - Student Result WordPress plugin through 1.0.4 is lacking CSRF and validation when uploading the School logo, which could allow attackers to make a logged in admin upload arbitrary files, such… Full details
HIGH 8.8
CVE-2022-2379 August 15, 2022
The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve information related to the courses, exams, departments as well as student's grades and PII such… Full details
HIGH 7.5
CVE-2022-2378 August 15, 2022
The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2354 August 15, 2022
The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should. Full details
HIGH 7.2
CVE-2022-2314 August 15, 2022
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site. Full details
CRITICAL 9.8
CVE-2022-2180 August 15, 2022
The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading… Full details
CRITICAL 9.8
CVE-2022-2152 August 15, 2022
The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is… Full details
MEDIUM 4.8
CVE-2022-2116 August 15, 2022
The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2460 August 8, 2022
The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users Full details
CRITICAL 9.8
CVE-2022-2426 August 8, 2022
The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators. Full details
MEDIUM 4.8
CVE-2022-2425 August 8, 2022
The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when… Full details
MEDIUM 4.8
CVE-2022-2424 August 8, 2022
The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the… Full details
MEDIUM 4.8
CVE-2022-2423 August 8, 2022
The DW Promobar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2022-2412 August 8, 2022
The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the… Full details
MEDIUM 4.8
CVE-2022-2411 August 8, 2022
The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the… Full details
MEDIUM 4.8
CVE-2022-2410 August 8, 2022
The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2022-2409 August 8, 2022
The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-2398 August 8, 2022
The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Full details
MEDIUM 4.8
CVE-2022-2395 August 8, 2022
The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-2391 August 8, 2022
The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description. Full details
MEDIUM 5.4
CVE-2022-2386 August 8, 2022
The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2372 August 8, 2022
The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability… Full details
MEDIUM 4.8
CVE-2022-2371 August 8, 2022
The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site… Full details
MEDIUM 5.4
CVE-2022-2367 August 8, 2022
The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation Full details
HIGH 7.5
CVE-2022-2357 August 8, 2022
The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php. Full details
HIGH 7.5
CVE-2022-2356 August 8, 2022
The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded. Full details
HIGH 8.8
CVE-2022-2355 August 8, 2022
The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin Full details
MEDIUM 6.5
CVE-2022-2269 August 8, 2022
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by… Full details
CRITICAL 9.8
CVE-2022-2046 August 8, 2022
The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This… Full details
MEDIUM 4.9
CVE-2022-1323 August 8, 2022
The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users (with privileges as low as Subscriber,) to change Theme options by sending… Full details
MEDIUM 6.5
CVE-2022-36296 August 5, 2022
Broken Authentication vulnerability in JumpDEMAND Inc. ActiveDEMAND plugin Full details
MEDIUM 5.3
CVE-2022-36284 August 5, 2022
Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin Full details
MEDIUM 6.5
CVE-2022-33201 August 5, 2022
Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin Full details
HIGH 8.8
CVE-2022-25649 August 5, 2022
Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin Full details
HIGH 8.8
CVE-2021-36861 August 5, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Rich Reviews by Starfish plugin Full details
MEDIUM 4.3
CVE-2022-36343 August 1, 2022
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin Full details
MEDIUM 5.4
CVE-2022-34154 August 1, 2022
Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin Full details
HIGH 8.8
CVE-2022-2370 August 1, 2022
The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them Full details
MEDIUM 6.5