blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,605
Affected records46,308
Newest source updateNovember 9, 2026
CVE-2021-34668 August 30, 2021
The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in… Full details
MEDIUM 5.4
CVE-2021-34646 August 30, 2021
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found… Full details
CRITICAL 9.8
CVE-2021-24665 August 30, 2021
The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks Full details
MEDIUM 5.4
CVE-2021-24593 August 30, 2021
The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue Full details
MEDIUM 5.4
CVE-2021-24592 August 30, 2021
The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html… Full details
MEDIUM 4.8
CVE-2021-24581 August 30, 2021
The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have… Full details
HIGH 8.8
CVE-2021-24580 August 30, 2021
The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue Full details
HIGH 8.8
CVE-2021-24579 August 30, 2021
The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even… Full details
HIGH 8.8
CVE-2021-24528 August 30, 2021
The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by… Full details
MEDIUM 5.4
CVE-2021-24438 August 30, 2021
The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected… Full details
MEDIUM 6.1
CVE-2021-24437 August 30, 2021
The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed… Full details
MEDIUM 6.1
CVE-2021-24658 August 23, 2021
The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled) Full details
MEDIUM 4.8
CVE-2021-24602 August 23, 2021
The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page Full details
HIGH 8.8
CVE-2021-24574 August 23, 2021
The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as admin to use Cross-Site Scripting payload even when the unfiltered_html capability is… Full details
MEDIUM 4.8
CVE-2021-24571 August 23, 2021
The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, which could lead to Stored Cross-Site Scripting issues Full details
MEDIUM 5.4
CVE-2021-24565 August 23, 2021
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them.… Full details
HIGH 8.8
CVE-2021-24564 August 23, 2021
The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability… Full details
MEDIUM 5.4
CVE-2021-24562 August 23, 2021
The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades Full details
HIGH 7.5
CVE-2021-24561 August 23, 2021
The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue Full details
MEDIUM 5.4
CVE-2021-24558 August 23, 2021
The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related… Full details
MEDIUM 5.4
CVE-2021-24556 August 23, 2021
The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted subscribe_email and subscribe_name POST parameters, inserting them in the DB and then outputting… Full details
MEDIUM 6.1
CVE-2021-24554 August 23, 2021
The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL… Full details
HIGH 7.2
CVE-2021-24553 August 23, 2021
The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing events, leading to an authenticated SQL injection issue.… Full details
HIGH 7.2
CVE-2021-24552 August 23, 2021
The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the event_id POST parameter before using it in a SQL statement when deleting events, leading to an authenticated SQL injection… Full details
HIGH 7.2
CVE-2021-24551 August 23, 2021
The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in a SQL statement, leading to a SQL injection issue Full details
CRITICAL 9.8
CVE-2021-24550 August 23, 2021
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retrieving an URL to edit, leading to an… Full details
HIGH 7.2
CVE-2021-24549 August 23, 2021
The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the… Full details
MEDIUM 4.9
CVE-2021-24547 August 23, 2021
The KN Fix Your Title WordPress plugin through 1.0.1 was vulnerable to Authenticated Stored XSS in the separator field. Full details
MEDIUM 5.4
CVE-2021-24533 August 23, 2021
The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them (even when the unfiltered_html capability… Full details
MEDIUM 4.8
CVE-2021-24531 August 23, 2021
The Charitable – Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature. Full details
MEDIUM 5.4
CVE-2021-24529 August 23, 2021
The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored… Full details
MEDIUM 5.4
CVE-2021-24524 August 23, 2021
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them. Full details
MEDIUM 4.8
CVE-2021-24506 August 23, 2021
The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing… Full details
HIGH 8.8
CVE-2021-24497 August 23, 2021
The Giveaway WordPress plugin through 1.2.2 is vulnerable to an SQL Injection issue which allows an administrative user to execute arbitrary SQL commands via the $post_id on the options.php page. Full details
HIGH 7.2
CVE-2021-24486 August 23, 2021
The Simple Social Media Share Buttons – Social Sharing for Everyone WordPress plugin before 3.2.3 did not escape the align and like_button_size parameters of its SSB shortcode, which could allow users with a role… Full details
MEDIUM 5.4
CVE-2021-37597 August 19, 2021
WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation. Full details
CRITICAL 9.8
CVE-2021-34645 August 19, 2021
The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/inc/wp_easycart_admin_initial_setup.php file which allows attackers to inject arbitrary web scripts, in versions up… Full details
HIGH 8.8
CVE-2021-38315 August 16, 2021
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in… Full details
MEDIUM 6.1
CVE-2021-34667 August 16, 2021
The Calendar_plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of `$_SERVER['PHP_SELF']` in the ~/calendar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including… Full details
MEDIUM 6.1
CVE-2021-34666 August 16, 2021
The Add Sidebar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the ~/wp_sidebarMenu.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.0. Full details
MEDIUM 6.1
CVE-2021-34665 August 16, 2021
The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saq_txt_the_filter parameter in the ~/wp-seo-tags.php file which allows attackers to inject arbitrary web scripts, in versions up to and including… Full details
MEDIUM 6.1
CVE-2021-34664 August 16, 2021
The Moova for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the lat parameter in the ~/Checkout/Checkout.php file which allows attackers to inject arbitrary web scripts, in versions up to and including… Full details
MEDIUM 6.1
CVE-2021-34663 August 16, 2021
The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to… Full details
MEDIUM 6.1
CVE-2021-34659 August 16, 2021
The Plugmatter Pricing Table Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `email` parameter in the ~/license.php file which allows attackers to inject arbitrary web scripts, in versions up to and… Full details
MEDIUM 6.1