blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2022-29411 April 28, 2022
SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin Full details
CRITICAL 9.8
CVE-2022-29410 April 28, 2022
Authenticated SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin Full details
HIGH 8.8
CVE-2022-29415 April 28, 2022
Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin Full details
MEDIUM 6.1
CVE-2022-27860 April 28, 2022
Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin Full details
MEDIUM 6.1
CVE-2022-27854 April 26, 2022
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin Full details
MEDIUM 5.4
CVE-2021-36895 April 26, 2022
Unauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin Full details
MEDIUM 6.1
CVE-2021-36867 April 26, 2022
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin Full details
MEDIUM 5.4
CVE-2022-29418 April 25, 2022
Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) in Mark Daniels Night Mode plugin Full details
MEDIUM 4.8
CVE-2022-29417 April 25, 2022
Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin Full details
MEDIUM 4.3
CVE-2022-28290 April 25, 2022
Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the specified payload as a part of the… Full details
MEDIUM 6.1
CVE-2022-1396 April 25, 2022
The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is… Full details
MEDIUM 4.8
CVE-2022-1392 April 25, 2022
The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues Full details
HIGH 7.5
CVE-2022-1391 April 25, 2022
The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues. Full details
CRITICAL 9.8
CVE-2022-1390 April 25, 2022
The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP… Full details
CRITICAL 9.8
CVE-2022-1228 April 25, 2022
The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could allow high privilege users to perform Cross-Site Scripting attacks even when the… Full details
MEDIUM 4.8
CVE-2022-1156 April 25, 2022
The Books & Papers WordPress plugin through 0.20210223 does not escape its Custom DB prefix settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Full details
MEDIUM 4.8
CVE-2022-1153 April 25, 2022
The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks… Full details
MEDIUM 4.8
CVE-2022-1152 April 25, 2022
The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users), leading to a… Full details
MEDIUM 5.4
CVE-2022-1094 April 25, 2022
The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… Full details
MEDIUM 4.8
CVE-2022-1092 April 25, 2022
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in… Full details
MEDIUM 4.3
CVE-2022-1027 April 25, 2022
The Page Restriction WordPress (WP) WordPress plugin before 1.2.7 allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only… Full details
MEDIUM 4.8
CVE-2022-0953 April 25, 2022
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which… Full details
MEDIUM 6.1
CVE-2022-0876 April 25, 2022
The Social comments by WpDevArt WordPress plugin before 2.5.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when unfiltered_html is disallowed Full details
MEDIUM 4.8
CVE-2022-0782 April 25, 2022
The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated… Full details
CRITICAL 9.8
CVE-2022-0769 April 25, 2022
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available… Full details
CRITICAL 9.8
CVE-2022-0693 April 25, 2022
The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement,… Full details
CRITICAL 9.8
CVE-2022-0657 April 25, 2022
The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtngg_delete_leads AJAX action,… Full details
CRITICAL 9.8
CVE-2022-0656 April 25, 2022
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the… Full details
HIGH 7.5
CVE-2022-0634 April 25, 2022
The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a role as low as Subscriber) to add an image from an external URL to an… Full details
MEDIUM 4.3
CVE-2022-0541 April 25, 2022
The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flo_custom_table_prefix cookie to an arbitrary value. Full details
CRITICAL 9.8
CVE-2022-0398 April 25, 2022
The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links,… Full details
MEDIUM 5.4
CVE-2022-0363 April 25, 2022
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus… Full details
MEDIUM 4.3
CVE-2022-0287 April 25, 2022
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the… Full details
MEDIUM 4.3
CVE-2021-4225 April 25, 2022
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed… Full details
HIGH 8.8
CVE-2021-46782 April 25, 2022
The Pricing Table by Supsystic WordPress plugin before 1.9.5 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2021-46781 April 25, 2022
The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2021-46780 April 25, 2022
The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting Full details
MEDIUM 6.1
CVE-2021-25111 April 25, 2022
The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue Full details
MEDIUM 6.1
CVE-2021-25094 April 25, 2022
The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with… Full details
HIGH 8.1
CVE-2021-24957 April 25, 2022
The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to… Full details
HIGH 8.8
CVE-2021-24805 April 25, 2022
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update… Full details
MEDIUM 4.3
CVE-2021-24800 April 25, 2022
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments. Full details
MEDIUM 4.3
CVE-2022-27863 April 19, 2022
Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin Full details
MEDIUM 5.3
CVE-2022-27862 April 19, 2022
Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin Full details
CRITICAL 9.8
CVE-2022-1329 April 19, 2022
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify… Full details
HIGH 8.8
CVE-2022-1187 April 19, 2022
The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and… Full details
MEDIUM 6.1
CVE-2022-1186 April 19, 2022
The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5. Full details
MEDIUM 5.3