blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-2369 August 1, 2022
The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin Full details
MEDIUM 4.3
CVE-2022-2328 August 1, 2022
The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-2325 August 1, 2022
The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the… Full details
MEDIUM 4.8
CVE-2022-2317 August 1, 2022
The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter. Full details
CRITICAL 9.8
CVE-2022-2305 August 1, 2022
The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2022-2278 August 1, 2022
The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting… Full details
MEDIUM 4.8
CVE-2022-2273 August 1, 2022
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request. Full details
HIGH 8.8
CVE-2022-2260 August 1, 2022
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in… Full details
MEDIUM 6.5
CVE-2022-2245 August 1, 2022
The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in admin perform such actions via CSRF attacks Full details
HIGH 8.8
CVE-2022-2241 August 1, 2022
The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via… Full details
MEDIUM 6.1
CVE-2022-2215 August 1, 2022
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability… Full details
MEDIUM 4.8
CVE-2022-2184 August 1, 2022
The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to… Full details
HIGH 8.8
CVE-2022-2181 August 1, 2022
The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2171 August 1, 2022
The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary… Full details
MEDIUM 5.4
CVE-2022-2170 August 1, 2022
The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2022-1950 August 1, 2022
The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection Full details
CRITICAL 9.8
CVE-2022-1906 August 1, 2022
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site… Full details
MEDIUM 6.1
CVE-2022-1600 August 1, 2022
The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations. Full details
MEDIUM 5.3
CVE-2022-1585 August 1, 2022
The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files… Full details
HIGH 7.5
CVE-2022-1324 August 1, 2022
The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Full details
MEDIUM 4.8
CVE-2022-0598 August 1, 2022
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-33994 July 30, 2022
The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context… Full details
LOW 3
CVE-2022-36378 July 29, 2022
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin Full details
MEDIUM 4.8
CVE-2016-0796 July 28, 2022
WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacker may leverage… Full details
HIGH 7.5
CVE-2022-35882 July 28, 2022
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin Full details
MEDIUM 4.8
CVE-2022-33943 July 27, 2022
Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin Full details
MEDIUM 5.4
CVE-2022-33970 July 27, 2022
Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin Full details
HIGH 7.2
CVE-2022-36375 July 25, 2022
Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin Full details
HIGH 7.2
CVE-2022-33969 July 25, 2022
Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin Full details
HIGH 7.2
CVE-2022-33965 July 25, 2022
Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin Full details
CRITICAL 9.8
CVE-2022-2341 July 25, 2022
The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the… Full details
MEDIUM 4.8
CVE-2022-2340 July 25, 2022
The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability… Full details
MEDIUM 4.8
CVE-2022-2299 July 25, 2022
The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads Full details
MEDIUM 5.4
CVE-2022-2240 July 25, 2022
The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once… Full details
HIGH 8.8
CVE-2022-2239 July 25, 2022
The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability… Full details
MEDIUM 4.8
CVE-2022-2219 July 25, 2022
The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Full details
HIGH 7.2
CVE-2022-2189 July 25, 2022
The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Full details
MEDIUM 6.1
CVE-2022-2115 July 25, 2022
The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2072 July 25, 2022
The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved… Full details
MEDIUM 6.1
CVE-2022-2071 July 25, 2022
The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers… Full details
MEDIUM 6.1
CVE-2022-1551 July 25, 2022
The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files. Full details
MEDIUM 6.5
CVE-2022-1539 July 25, 2022
The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE… Full details
HIGH 8.8
CVE-2022-0899 July 25, 2022
The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting. Full details
MEDIUM 6.1
CVE-2022-0594 July 25, 2022
The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+… Full details
MEDIUM 5.3
CVE-2022-34853 July 22, 2022
Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin Full details
MEDIUM 5.4
CVE-2022-34839 July 22, 2022
Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin Full details
CRITICAL 9.8
CVE-2022-34650 July 22, 2022
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin Full details
MEDIUM 5.4
CVE-2022-33960 July 22, 2022
Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin Full details
HIGH 8.8
CVE-2022-33901 July 22, 2022
Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin Full details
HIGH 7.5
CVE-2022-33191 July 22, 2022
Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin Full details
MEDIUM 5.4