blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-29427 May 20, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin Full details
HIGH 8.8
CVE-2022-29426 May 20, 2022
Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin Full details
MEDIUM 5.4
CVE-2022-29448 May 20, 2022
Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin Full details
MEDIUM 4.9
CVE-2022-29425 May 20, 2022
Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin Full details
MEDIUM 6.1
CVE-2022-29424 May 20, 2022
Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin Full details
MEDIUM 4.8
CVE-2021-36833 May 20, 2022
Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin Full details
MEDIUM 4.8
CVE-2022-29449 May 19, 2022
Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booking plugin Full details
MEDIUM 5.4
CVE-2022-29446 May 19, 2022
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin Full details
HIGH 7.2
CVE-2022-29445 May 18, 2022
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin Full details
HIGH 7.2
CVE-2022-29436 May 17, 2022
Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin Full details
MEDIUM 6.1
CVE-2022-29435 May 17, 2022
Cross-Site Request Forgery (CSRF) vulnerability in Alexander Stokmann's Code Snippets Extended plugin Full details
MEDIUM 5.4
CVE-2022-29429 May 17, 2022
Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin Full details
HIGH 8.8
CVE-2022-1560 May 16, 2022
The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users… Full details
MEDIUM 6.5
CVE-2022-1559 May 16, 2022
The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is… Full details
MEDIUM 4.8
CVE-2022-1557 May 16, 2022
The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which… Full details
MEDIUM 5.4
CVE-2022-1512 May 16, 2022
The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Full details
MEDIUM 4.8
CVE-2022-1465 May 16, 2022
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting… Full details
MEDIUM 6.1
CVE-2022-1455 May 16, 2022
The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, leading to a Reflected Cross-Site Scripting when the premium is… Full details
MEDIUM 6.1
CVE-2022-1436 May 16, 2022
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks. Full details
MEDIUM 6.1
CVE-2022-1435 May 16, 2022
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2022-1425 May 16, 2022
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting… Full details
MEDIUM 4.3
CVE-2022-1418 May 16, 2022
The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does not escape some of these fields, which could allow attackers to make… Full details
MEDIUM 6.1
CVE-2022-1409 May 16, 2022
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP… Full details
HIGH 7.2
CVE-2022-1408 May 16, 2022
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting… Full details
MEDIUM 4.8
CVE-2022-1407 May 16, 2022
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In… Full details
MEDIUM 6.5
CVE-2022-1398 May 16, 2022
The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as… Full details
MEDIUM 6.5
CVE-2022-1393 May 16, 2022
The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subtitle]. The subtitle is stored as a custom post meta with the key: "wps_subtitle", which… Full details
MEDIUM 5.4
CVE-2022-1386 May 16, 2022
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then… Full details
CRITICAL 9.8
CVE-2022-1349 May 16, 2022
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_id parameter of the ajax action… Full details
MEDIUM 4.3
CVE-2022-1334 May 16, 2022
The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2022-1267 May 16, 2022
The BMI BMR Calculator WordPress plugin through 1.3 does not sanitise and escape arbitrary POST data before outputting it back in the response, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2022-1265 May 16, 2022
The BulletProof Security WordPress plugin before 6.1 does not sanitize and escape some of its CAPTCHA settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Full details
MEDIUM 4.8
CVE-2022-1217 May 16, 2022
The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting. Full details
MEDIUM 6.1
CVE-2022-1216 May 16, 2022
The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting. Full details
MEDIUM 6.1
CVE-2022-1182 May 16, 2022
The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (such… Full details
HIGH 8.8
CVE-2022-1103 May 16, 2022
The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE Full details
HIGH 8.8
CVE-2022-1089 May 16, 2022
The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks… Full details
MEDIUM 4.8
CVE-2022-1062 May 16, 2022
The th23 Social WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2022-1051 May 16, 2022
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profile credentials fields when outputting it… Full details
MEDIUM 5.4
CVE-2022-0873 May 16, 2022
The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin… Full details
MEDIUM 4.8
CVE-2022-0867 May 16, 2022
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available… Full details
CRITICAL 9.8
CVE-2021-25119 May 16, 2022
The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file… Full details
HIGH 7.2
CVE-2022-29433 May 13, 2022
Authenticated (contributor or higher role) Cross-Site Scripting (XSS) vulnerability in Donations plugin Full details
MEDIUM 5.4
CVE-2022-1567 May 10, 2022
The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echoes it back to the user. This can be used for reflected Cross-Site Scripting… Full details
MEDIUM 6.1
CVE-2022-1505 May 10, 2022
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file. This makes it… Full details
HIGH 7.5
CVE-2022-1476 May 10, 2022
The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can… Full details
MEDIUM 6.5
CVE-2022-1463 May 10, 2022
The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call… Full details
HIGH 8.8