blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-32280 June 15, 2022
Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Xakuro's XO Slider plugin Full details
MEDIUM 5.4
CVE-2022-29452 June 15, 2022
Authenticated (editor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Export All URLs plugin Full details
MEDIUM 4.8
CVE-2022-28612 June 15, 2022
Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Muneeb's Custom Popup Builder plugin Full details
MEDIUM 5.4
CVE-2021-36891 June 15, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin Full details
MEDIUM 4.3
CVE-2022-29450 June 15, 2022
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin Full details
HIGH 8.8
CVE-2022-29443 June 15, 2022
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin Full details
MEDIUM 5.4
CVE-2022-29453 June 15, 2022
Cross-Site Request Forgery (CSRF) vulnerability in API KEY for Google Maps plugin Full details
MEDIUM 4.3
CVE-2022-29442 June 15, 2022
Authenticated (subscriber or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Messages For WordPress Full details
MEDIUM 5.4
CVE-2022-29441 June 15, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Private Messages For WordPress plugin Full details
MEDIUM 4.3
CVE-2022-29440 June 15, 2022
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin Full details
MEDIUM 5.4
CVE-2022-29439 June 15, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Image Slider by NextCode plugin Full details
MEDIUM 4.3
CVE-2022-29438 June 15, 2022
Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin Full details
MEDIUM 4.8
CVE-2022-29437 June 15, 2022
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin Full details
HIGH 8.8
CVE-2022-29406 June 15, 2022
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in DynamicWebLab's WordPress Team Manager plugin Full details
MEDIUM 5.4
CVE-2022-27859 June 15, 2022
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark d.o.o. Travel Management plugin Full details
MEDIUM 5.4
CVE-2021-36901 June 15, 2022
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin Full details
MEDIUM 6.1
CVE-2022-1969 June 13, 2022
The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the admin_update_data() function.… Full details
HIGH 8.8
CVE-2022-1961 June 13, 2022
The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller-contentid]` parameter found in the `~/public/frontend.php` file which allowed attackers with administrative user access… Full details
MEDIUM 4.8
CVE-2022-1820 June 13, 2022
The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes… Full details
MEDIUM 6.1
CVE-2022-1768 June 13, 2022
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible… Full details
HIGH 7.5
CVE-2022-1750 June 13, 2022
The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes… Full details
MEDIUM 4.8
CVE-2022-1749 June 13, 2022
The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in… Full details
HIGH 8.8
CVE-2022-0209 June 13, 2022
The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site… Full details
MEDIUM 4.8
CVE-2022-1985 June 13, 2022
The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found… Full details
MEDIUM 6.1
CVE-2022-1918 June 13, 2022
The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing nonce validation on the plugin_toolbar_comparte page. This makes it… Full details
HIGH 8.8
CVE-2022-1900 June 13, 2022
The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on the CopifySettings page. This makes it possible for… Full details
HIGH 8.8
CVE-2022-1822 June 13, 2022
The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes… Full details
MEDIUM 6.1
CVE-2022-1814 June 13, 2022
The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the… Full details
MEDIUM 4.8
CVE-2022-1800 June 13, 2022
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection… Full details
HIGH 7.2
CVE-2022-1793 June 13, 2022
The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make… Full details
MEDIUM 4.3
CVE-2022-1792 June 13, 2022
The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack… Full details
MEDIUM 5.4
CVE-2022-1791 June 13, 2022
The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a… Full details
HIGH 8.1
CVE-2022-1790 June 13, 2022
The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via… Full details
MEDIUM 6.5
CVE-2022-1788 June 13, 2022
Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could… Full details
MEDIUM 6.5
CVE-2022-1787 June 13, 2022
The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and… Full details
MEDIUM 5.4
CVE-2022-1781 June 13, 2022
The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which… Full details
MEDIUM 5.4
CVE-2022-1780 June 13, 2022
The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack… Full details
MEDIUM 5.4
CVE-2022-1779 June 13, 2022
The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF… Full details
HIGH 8.1
CVE-2022-1777 June 13, 2022
The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with… Full details
HIGH 8.8
CVE-2022-1773 June 13, 2022
The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-1772 June 13, 2022
The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a… Full details
MEDIUM 4.8
CVE-2022-1765 June 13, 2022
The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server, which could lead to legal risks… Full details
HIGH 8.8
CVE-2022-1764 June 13, 2022
The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and… Full details
MEDIUM 5.4
CVE-2022-1763 June 13, 2022
Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead… Full details
MEDIUM 5.4
CVE-2022-1762 June 13, 2022
The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers. Full details
HIGH 7.5
CVE-2022-1761 June 13, 2022
The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level,… Full details
MEDIUM 6.5
CVE-2022-1759 June 13, 2022
The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF… Full details
MEDIUM 5.4
CVE-2022-1758 June 13, 2022
The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF… Full details
HIGH 8.8
CVE-2022-1756 June 13, 2022
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still… Full details
MEDIUM 6.1
CVE-2022-1724 June 13, 2022
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting Full details
MEDIUM 6.1