blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-1843 June 27, 2022
The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF… Full details
MEDIUM 6.5
CVE-2022-1842 June 27, 2022
The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF… Full details
MEDIUM 4.3
CVE-2022-1776 June 27, 2022
The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign parameters, which could allow users with a role as low as contributor to perform… Full details
MEDIUM 5.4
CVE-2022-1653 June 27, 2022
The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or… Full details
MEDIUM 4.3
CVE-2022-1627 June 27, 2022
The My Private Site WordPress plugin before 3.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF… Full details
MEDIUM 4.3
CVE-2022-1625 June 27, 2022
The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the… Full details
MEDIUM 4.3
CVE-2022-1593 June 27, 2022
The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them.… Full details
MEDIUM 6.1
CVE-2022-1574 June 27, 2022
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on… Full details
CRITICAL 9.8
CVE-2022-1573 June 27, 2022
The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them Full details
MEDIUM 4.3
CVE-2022-1572 June 27, 2022
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file Full details
HIGH 8.1
CVE-2022-1470 June 27, 2022
The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-1327 June 27, 2022
The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is… Full details
MEDIUM 4.8
CVE-2022-1326 June 27, 2022
The Form - Contact Form WordPress plugin through 1.2.0 does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is… Full details
MEDIUM 4.8
CVE-2022-1321 June 27, 2022
The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks… Full details
MEDIUM 4.8
CVE-2022-1113 June 27, 2022
The Flower Delivery by Florist One WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks… Full details
MEDIUM 4.8
CVE-2022-1095 June 27, 2022
The Mihdan: No External Links WordPress plugin before 5.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even… Full details
MEDIUM 4.8
CVE-2022-1029 June 27, 2022
The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks… Full details
MEDIUM 4.8
CVE-2022-1028 June 27, 2022
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code… Full details
MEDIUM 4.8
CVE-2022-1010 June 27, 2022
The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… Full details
MEDIUM 4.8
CVE-2022-0875 June 27, 2022
The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change… Full details
MEDIUM 4.3
CVE-2022-0444 June 27, 2022
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating… Full details
MEDIUM 4.3
CVE-2013-1916 June 24, 2022
In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called… Full details
HIGH 8.8
CVE-2022-1945 June 20, 2022
The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfiltered_html is… Full details
MEDIUM 4.8
CVE-2022-1939 June 20, 2022
The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to Full details
HIGH 7.2
CVE-2022-1915 June 20, 2022
The WP Zillow Review Slider WordPress plugin before 2.4 does not escape a settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example… Full details
MEDIUM 4.8
CVE-2022-1905 June 20, 2022
The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a… Full details
CRITICAL 9.8
CVE-2022-1896 June 20, 2022
The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even… Full details
MEDIUM 4.8
CVE-2022-1895 June 20, 2022
The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF… Full details
MEDIUM 4.3
CVE-2022-1889 June 20, 2022
The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed Full details
MEDIUM 4.8
CVE-2022-1832 June 20, 2022
The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack… Full details
MEDIUM 6.5
CVE-2022-1831 June 20, 2022
The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Full details
MEDIUM 6.5
CVE-2022-1830 June 20, 2022
The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack… Full details
MEDIUM 6.5
CVE-2022-1829 June 20, 2022
The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF… Full details
MEDIUM 6.5
CVE-2022-1828 June 20, 2022
The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a… Full details
MEDIUM 6.5
CVE-2022-1827 June 20, 2022
The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a… Full details
MEDIUM 6.5
CVE-2022-1826 June 20, 2022
The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in admin perform such action via a CSRF attack Full details
MEDIUM 6.5
CVE-2022-1818 June 20, 2022
The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack… Full details
MEDIUM 5.4
CVE-2022-1801 June 20, 2022
The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it… Full details
HIGH 7.5
CVE-2022-1717 June 20, 2022
The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting… Full details
MEDIUM 4.8
CVE-2022-1630 June 20, 2022
The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack Full details
MEDIUM 6.5
CVE-2022-1614 June 20, 2022
The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based anti-spamming restrictions. Full details
HIGH 7.5
CVE-2022-1610 June 20, 2022
The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Full details
MEDIUM 6.5
CVE-2022-1603 June 20, 2022
The Mail Subscribe List WordPress plugin before 2.1.4 does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a logged in admin perform such action and delete… Full details
MEDIUM 4.3
CVE-2022-1472 June 20, 2022
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection Full details
HIGH 7.2
CVE-2022-1266 June 20, 2022
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2022-0663 June 20, 2022
The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks… Full details
MEDIUM 4.8
CVE-2021-25121 June 20, 2022
The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating Full details
MEDIUM 6.5
CVE-2021-25104 June 20, 2022
The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue Full details
MEDIUM 6.1
CVE-2021-25088 June 20, 2022
The XML Sitemaps WordPress plugin before 4.1.3 does not sanitise and escape a settings before outputting it in the Debug page, which could allow high privilege users to perform Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2021-36827 June 16, 2022
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin Full details
MEDIUM 4.8