blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,605
Affected records46,308
Newest source updateNovember 9, 2026
CVE-2021-24654 October 4, 2021
The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored… Full details
MEDIUM 5.4
CVE-2021-24465 October 4, 2021
The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode (available for users as low as Contributor) before using it in an SQL statement,… Full details
HIGH 8.1
CVE-2021-39342 September 29, 2021
The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova… Full details
HIGH 7.5
CVE-2021-34636 September 28, 2021
The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to… Full details
HIGH 8.8
CVE-2021-36880 September 27, 2021
Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions Full details
CRITICAL 9.8
CVE-2021-36879 September 27, 2021
Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions Full details
CRITICAL 9.8
CVE-2021-36877 September 27, 2021
Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions Full details
MEDIUM 6.5
CVE-2021-36876 September 27, 2021
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions Full details
HIGH 8.8
CVE-2021-36875 September 27, 2021
Cross-site Scripting (XSS) vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS.This issue affects Directory Listings WordPress plugin – uListing: from n/a through 2.0.5. Full details
MEDIUM 4.8
CVE-2021-36874 September 27, 2021
Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions Full details
HIGH 8.8
CVE-2021-36841 September 27, 2021
Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions Full details
MEDIUM 5.4
CVE-2021-24671 September 27, 2021
The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks Full details
MEDIUM 5.4
CVE-2021-24670 September 27, 2021
The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks Full details
MEDIUM 5.4
CVE-2021-24666 September 27, 2021
The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters… Full details
CRITICAL 9.8
CVE-2021-24661 September 27, 2021
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is… Full details
MEDIUM 4.3
CVE-2021-24660 September 27, 2021
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the… Full details
MEDIUM 5.4
CVE-2021-24659 September 27, 2021
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block. Full details
MEDIUM 5.4
CVE-2021-24652 September 27, 2021
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or… Full details
MEDIUM 6.5
CVE-2021-24643 September 27, 2021
The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting… Full details
MEDIUM 5.4
CVE-2021-24634 September 27, 2021
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings),… Full details
MEDIUM 5.4
CVE-2021-24633 September 27, 2021
The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users. Full details
MEDIUM 4.3
CVE-2021-24632 September 27, 2021
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue Full details
MEDIUM 6.1
CVE-2021-24610 September 27, 2021
The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to… Full details
MEDIUM 4.8
CVE-2021-24569 September 27, 2021
The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outputting it in an attribute in the frontend, allowing high… Full details
MEDIUM 4.8
CVE-2021-36878 September 27, 2021
Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions Full details
MEDIUM 4.3
CVE-2021-36873 September 23, 2021
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions Full details
MEDIUM 5.4
CVE-2021-36872 September 23, 2021
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions Full details
MEDIUM 5.4
CVE-2021-34648 September 22, 2021
The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary… Full details
MEDIUM 4.3
CVE-2021-34647 September 22, 2021
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all… Full details
MEDIUM 6.5
CVE-2021-39339 September 22, 2021
The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file due to a user-supplied URL request value that gets called by a curl requests. This affects versions… Full details
MEDIUM 5.3
CVE-2021-34650 September 20, 2021
The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the ~/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including… Full details
MEDIUM 6.1
CVE-2021-39325 September 20, 2021
The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews function found in the ~/OMAPI/Output.php file which allows attackers to inject arbitrary web scripts, in versions… Full details
MEDIUM 6.1
CVE-2021-24741 September 20, 2021
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are… Full details
CRITICAL 9.8
CVE-2021-24663 September 20, 2021
The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP,… Full details
HIGH 7.2
CVE-2021-24657 September 20, 2021
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports… Full details
MEDIUM 6.1
CVE-2021-24640 September 20, 2021
The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks Full details
MEDIUM 5.4
CVE-2021-24639 September 20, 2021
The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server. Full details
HIGH 8.1
CVE-2021-24638 September 20, 2021
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts… Full details
CRITICAL 9.1
CVE-2021-24637 September 20, 2021
The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via… Full details
MEDIUM 5.4
CVE-2021-24636 September 20, 2021
The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrators deactivate the Print My Blog plugin and delete all saved data for… Full details
HIGH 8.1
CVE-2021-24635 September 20, 2021
The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to… Full details
MEDIUM 5.4
CVE-2021-24618 September 20, 2021
The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF… Full details
MEDIUM 5.4
CVE-2021-24613 September 20, 2021
The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when… Full details
MEDIUM 4.8
CVE-2021-24609 September 20, 2021
The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when… Full details
MEDIUM 4.8
CVE-2021-24606 September 20, 2021
The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by… Full details
HIGH 8.8
CVE-2021-24604 September 20, 2021
The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting… Full details
MEDIUM 4.8
CVE-2021-24600 September 20, 2021
The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2021-24597 September 20, 2021
The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues in frontend posts and the plugins settings page depending on the payload used Full details
MEDIUM 5.4
CVE-2021-24596 September 20, 2021
The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2021-24587 September 20, 2021
The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue. Full details
MEDIUM 5.4