blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,605
Affected records46,308
Newest source updateNovember 9, 2026
CVE-2019-18834 July 23, 2020
Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php. Full details
MEDIUM 6.1
CVE-2020-14063 July 21, 2020
A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page… Full details
MEDIUM 6.1
CVE-2020-5768 July 17, 2020
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote, authenticated attacker to determine the value of database fields. Full details
MEDIUM 4.9
CVE-2020-5767 July 17, 2020
Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link. Full details
MEDIUM 6.5
CVE-2020-5766 July 13, 2020
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database… Full details
HIGH 7.5
CVE-2020-15299 July 9, 2020
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST… Full details
MEDIUM 6.1
CVE-2020-15092 July 9, 2020
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the… Full details
MEDIUM 4.8
CVE-2020-15537 July 5, 2020
An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI, or the Products Search box. Full details
MEDIUM 6.1
CVE-2020-15536 July 5, 2020
An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields. Full details
MEDIUM 6.1
CVE-2020-15535 July 5, 2020
An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields. Full details
MEDIUM 6.1
CVE-2020-14092 July 2, 2020
The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection. Full details
CRITICAL 9.8
CVE-2020-15364 June 28, 2020
The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS. Full details
MEDIUM 6.1
CVE-2020-15363 June 28, 2020
The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection. Full details
CRITICAL 9.8
CVE-2020-13700 June 24, 2020
An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the… Full details
HIGH 7.5
CVE-2020-13426 June 22, 2020
The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents, allowing the possibility of deleting records (users) when an ID is known. Full details
MEDIUM 6.5
CVE-2020-14962 June 22, 2020
Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka description) field of… Full details
MEDIUM 5.4
CVE-2020-14959 June 22, 2020
Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product… Full details
MEDIUM 5.4
CVE-2020-13640 June 18, 2020
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are… Full details
CRITICAL 9.8
CVE-2019-19112 June 15, 2020
The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php. Full details
MEDIUM 6.1
CVE-2019-19111 June 15, 2020
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter. Full details
MEDIUM 6.1
CVE-2019-19110 June 15, 2020
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter. Full details
MEDIUM 4.8
CVE-2019-19109 June 15, 2020
The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF. Full details
HIGH 8.8
CVE-2020-4050 June 12, 2020
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter.… Full details
LOW 3.1
CVE-2020-4049 June 12, 2020
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does… Full details
LOW 2.4
CVE-2020-4048 June 12, 2020
In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2,… Full details
MEDIUM 5.7
CVE-2020-4047 June 12, 2020
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in… Full details
MEDIUM 6.8
CVE-2020-4046 June 12, 2020
In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are… Full details
MEDIUM 5.4
CVE-2020-14010 June 10, 2020
The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter. Full details
MEDIUM 6.1
CVE-2020-12800 June 8, 2020
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file. Full details
CRITICAL 9.8
CVE-2020-13865 June 5, 2020
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the… Full details
MEDIUM 5.4
CVE-2020-13864 June 5, 2020
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom… Full details
MEDIUM 5.4
CVE-2020-13764 June 2, 2020
common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call. Full details
HIGH 7.5
CVE-2019-11843 June 2, 2020
The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS). Full details
MEDIUM 6.1
CVE-2020-12675 May 29, 2020
The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of… Full details
HIGH 8.8
CVE-2020-13693 May 29, 2020
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. Full details
CRITICAL 9.8
CVE-2020-13644 May 28, 2020
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and… Full details
MEDIUM 5.4
CVE-2020-13643 May 28, 2020
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an… Full details
HIGH 8.8
CVE-2020-13642 May 28, 2020
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator.… Full details
HIGH 8.8
CVE-2020-13641 May 28, 2020
An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an… Full details
HIGH 8.8
CVE-2020-13487 May 26, 2020
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this… Full details
MEDIUM 4.8
CVE-2020-13126 May 17, 2020
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary… Full details
CRITICAL 9.9
CVE-2020-13125 May 17, 2020
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the… Full details
MEDIUM 6.5
CVE-2020-12832 May 13, 2020
WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. Full details
CRITICAL 9.8
CVE-2020-12742 May 13, 2020
The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols. Full details
MEDIUM 6.1
CVE-2020-11530 May 8, 2020
A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to get_script/index.php, and allows an attacker to execute arbitrary SQL… Full details
CRITICAL 9.8
CVE-2020-11727 May 6, 2020
A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter. Full details
MEDIUM 6.1
CVE-2020-8799 May 5, 2020
A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for… Full details
MEDIUM 4.8