blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-30998 July 22, 2022
Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugin Full details
HIGH 8.8
CVE-2022-29495 July 22, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin Full details
MEDIUM 4.3
CVE-2022-27235 July 22, 2022
Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin Full details
HIGH 8.8
CVE-2022-34487 July 21, 2022
Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin Full details
MEDIUM 5.3
CVE-2022-33198 July 21, 2022
Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin Full details
MEDIUM 5.3
CVE-2022-31475 July 21, 2022
Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin Full details
MEDIUM 4.9
CVE-2022-30536 July 21, 2022
Authenticated Stored Cross-Site Scripting (XSS) vulnerability in Florent Maillefaud's WP Maintenance plugin Full details
MEDIUM 4.8
CVE-2022-28700 July 21, 2022
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin Full details
HIGH 7.2
CVE-2022-30337 July 21, 2022
Cross-Site Request Forgery (CSRF) vulnerability in JoomUnited WP Meta SEO plugin Full details
MEDIUM 4.3
CVE-2022-28666 July 21, 2022
Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin Full details
MEDIUM 5.3
CVE-2022-32289 July 21, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin Full details
MEDIUM 4.3
CVE-2022-29454 July 20, 2022
Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin Full details
MEDIUM 4.3
CVE-2021-36849 July 20, 2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin Full details
MEDIUM 4.8
CVE-2022-2444 July 18, 2022
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for… Full details
HIGH 8.8
CVE-2022-2443 July 18, 2022
The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due to missing nonce protection on the FreemindOptions() function found in the… Full details
HIGH 8.8
CVE-2022-2437 July 18, 2022
The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter in versions up to, and including 2.9.8.5. This makes… Full details
CRITICAL 9.8
CVE-2022-2435 July 18, 2022
The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to missing nonce protection on the createDOMStructure() function found in the ~/anymind-widget-id.php… Full details
HIGH 8.8
CVE-2022-2224 July 18, 2022
The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly check for the existence of a nonce in the… Full details
MEDIUM 4.3
CVE-2022-2223 July 18, 2022
The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the existence of a nonce in the function ewic_duplicate_slider.… Full details
MEDIUM 4.3
CVE-2022-2117 July 18, 2022
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor… Full details
MEDIUM 5.3
CVE-2022-2108 July 18, 2022
The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said… Full details
MEDIUM 5.3
CVE-2022-2101 July 18, 2022
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2.46 due to insufficient input sanitization and output escaping. This makes it… Full details
MEDIUM 5.4
CVE-2022-2039 July 18, 2022
The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing nonce protection on the livesupporti_settings() function found in… Full details
HIGH 8.8
CVE-2022-2001 July 18, 2022
The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the dxss_admin_page() function found in the… Full details
HIGH 8.8
CVE-2022-1912 July 18, 2022
The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce validation on the smartsoftbutton_settings page. This makes it… Full details
HIGH 8.8
CVE-2022-2222 July 17, 2022
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php… Full details
MEDIUM 4.9
CVE-2022-2194 July 17, 2022
The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability… Full details
MEDIUM 4.8
CVE-2022-2187 July 17, 2022
The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Full details
MEDIUM 6.1
CVE-2022-2186 July 17, 2022
The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-2173 July 17, 2022
The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2169 July 17, 2022
The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-2168 July 17, 2022
The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-2151 July 17, 2022
The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is… Full details
MEDIUM 4.8
CVE-2022-2149 July 17, 2022
The Very Simple Breadcrumb WordPress plugin through 1.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-2148 July 17, 2022
The LinkedIn Company Updates WordPress plugin through 1.5.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-2146 July 17, 2022
The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check when performing such action as well, resulting… Full details
MEDIUM 6.1
CVE-2022-2144 July 17, 2022
The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change Blog… Full details
MEDIUM 4.3
CVE-2022-2133 July 17, 2022
The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email… Full details
MEDIUM 5.3
CVE-2022-2118 July 17, 2022
The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-2114 July 17, 2022
The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting… Full details
MEDIUM 4.8
CVE-2022-2100 July 17, 2022
The Page Generator WordPress plugin before 1.6.5 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details
MEDIUM 4.8
CVE-2022-2099 July 17, 2022
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles Full details
MEDIUM 4.8
CVE-2022-2090 July 17, 2022
The Discount Rules for WooCommerce WordPress plugin before 2.4.2 does not escape a parameter before outputting it back in an attribute of the plugin's discount rule page, leading to Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-1933 July 17, 2022
The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a… Full details
MEDIUM 6.1
CVE-2022-1672 July 17, 2022
The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform… Full details
HIGH 8.8
CVE-2021-24655 July 17, 2022
The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can… Full details
HIGH 7.5
CVE-2022-2123 July 11, 2022
The WP Opt-in WordPress plugin through 1.4.1 is vulnerable to CSRF which allows changed plugin settings and can be used for sending spam emails. Full details
MEDIUM 4.3
CVE-2022-2093 July 11, 2022
The WP Duplicate Page WordPress plugin before 1.3 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html… Full details
MEDIUM 4.8
CVE-2022-2092 July 11, 2022
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks. Full details
MEDIUM 6.1
CVE-2022-2091 July 11, 2022
The Cache Images WordPress plugin before 3.2.1 does not implement nonce checks, which could allow attackers to make any logged user upload images via a CSRF attack. Full details
MEDIUM 6.5