blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,605
Affected records46,308
Newest source updateNovember 9, 2026
CVE-2020-28978 November 30, 2020
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/tree.php?subdomain=SSRF. Full details
MEDIUM 5.3
CVE-2020-28977 November 30, 2020
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/get.php?subdomain=SSRF. Full details
MEDIUM 5.3
CVE-2020-28976 November 30, 2020
The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF. Full details
MEDIUM 5.3
CVE-2020-28650 November 16, 2020
The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles. Full details
MEDIUM 5.4
CVE-2020-28649 November 16, 2020
The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file. Full details
HIGH 8.8
CVE-2020-27481 November 12, 2020
An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin Full details
CRITICAL 9.8
CVE-2020-24063 November 10, 2020
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF. Full details
HIGH 7.2
CVE-2020-28339 November 7, 2020
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete POP chain. Full details
HIGH 8.8
CVE-2020-22277 November 4, 2020
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile. Full details
HIGH 8
CVE-2020-22276 November 4, 2020
WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry. Full details
CRITICAL 9.8
CVE-2020-22275 November 4, 2020
Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is… Full details
HIGH 8.8
CVE-2020-28040 November 2, 2020
WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. Full details
MEDIUM 4.3
CVE-2020-28039 November 2, 2020
is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected. Full details
CRITICAL 9.1
CVE-2020-28037 November 2, 2020
is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial… Full details
CRITICAL 9.8
CVE-2020-28036 November 2, 2020
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. Full details
CRITICAL 9.8
CVE-2020-28035 November 2, 2020
WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. Full details
CRITICAL 9.8
CVE-2020-28033 November 2, 2020
WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. Full details
HIGH 7.5
CVE-2020-28032 November 2, 2020
WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. Full details
CRITICAL 9.8
CVE-2020-16140 October 27, 2020
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS. Full details
MEDIUM 6.1
CVE-2020-27615 October 21, 2020
The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip. Full details
CRITICAL 9.8
CVE-2020-26672 October 16, 2020
Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the… Full details
MEDIUM 5.4
CVE-2020-26876 October 7, 2020
The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September… Full details
HIGH 7.5
CVE-2020-26596 October 7, 2020
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via… Full details
HIGH 8.8
CVE-2020-26511 October 2, 2020
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass. Full details
HIGH 7.5
CVE-2020-25380 September 14, 2020
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and… Full details
MEDIUM 5.4
CVE-2020-25379 September 14, 2020
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attacker to inject a malicious SQL query. Full details
HIGH 8.8
CVE-2020-25378 September 14, 2020
Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter. Full details
MEDIUM 6.1
CVE-2020-25375 September 14, 2020
Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field, Address field, Town field, Phone field, Mobile… Full details
MEDIUM 5.4
CVE-2020-25286 September 13, 2020
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public. Full details
MEDIUM 5.3
CVE-2020-5780 September 10, 2020
Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing. Full details
MEDIUM 5.3
CVE-2020-25213 September 9, 2020
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This,… Full details
CRITICAL 9.8
CVE-2020-24948 September 3, 2020
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to… Full details
HIGH 7.2
CVE-2020-24699 August 31, 2020
The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS. Full details
MEDIUM 6.1
CVE-2020-20627 August 31, 2020
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change. Full details
MEDIUM 5.3
CVE-2020-20626 August 31, 2020
lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS. Full details
MEDIUM 5.4
CVE-2020-20625 August 31, 2020
Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php. Full details
HIGH 7.5
CVE-2020-15020 August 31, 2020
An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field. Full details
MEDIUM 5.4
CVE-2020-25033 August 31, 2020
The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS. Full details
MEDIUM 6.1
CVE-2020-11497 August 26, 2020
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank… Full details
HIGH 7.5
CVE-2020-24315 August 26, 2020
Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements… Full details
HIGH 7.5
CVE-2020-24313 August 26, 2020
Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointment_ID" GET parameter before echoing it back out inside an input tag. This results… Full details
MEDIUM 6.1
CVE-2020-24186 August 24, 2020
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action. Full details
CRITICAL 10
CVE-2020-20633 August 21, 2020
ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation. Full details
MEDIUM 5.4
CVE-2020-20634 August 21, 2020
Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog. Full details
MEDIUM 6.5
CVE-2016-11085 August 16, 2020
php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element. Full details
MEDIUM 6.5
CVE-2019-6112 August 14, 2020
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search… Full details
MEDIUM 6.1
CVE-2020-17362 August 12, 2020
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. Full details
MEDIUM 6.1