blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,605
Affected records46,308
Newest source updateNovember 9, 2026
CVE-2020-8436 March 12, 2020
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter. Full details
MEDIUM 6.1
CVE-2020-8435 March 12, 2020
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form_id parameter. Full details
HIGH 8.1
CVE-2018-14502 March 10, 2020
controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters. Full details
CRITICAL 9.8
CVE-2020-10257 March 10, 2020
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe… Full details
CRITICAL 9.8
CVE-2020-9458 March 6, 2020
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export. Full details
HIGH 8.8
CVE-2020-9457 March 6, 2020
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation. Full details
HIGH 8.8
CVE-2020-9456 March 6, 2020
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit. Full details
HIGH 8.8
CVE-2020-9455 March 6, 2020
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view. Full details
MEDIUM 4.3
CVE-2020-9454 March 6, 2020
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating… Full details
HIGH 8.8
CVE-2020-9372 March 4, 2020
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the… Full details
HIGH 7.8
CVE-2020-9371 March 4, 2020
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML. Full details
MEDIUM 4.8
CVE-2020-9459 February 28, 2020
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax… Full details
MEDIUM 5.4
CVE-2020-9466 February 28, 2020
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection. Full details
MEDIUM 6.1
CVE-2019-19134 February 26, 2020
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue… Full details
MEDIUM 6.1
CVE-2020-9394 February 25, 2020
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF. Full details
HIGH 8.8
CVE-2020-9393 February 25, 2020
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS. Full details
MEDIUM 6.1
CVE-2020-9019 February 25, 2020
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description. Full details
MEDIUM 6.1
CVE-2020-9335 February 25, 2020
Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by… Full details
MEDIUM 4.8
CVE-2020-9334 February 25, 2020
A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a authenticated low-privileged user to inject arbitrary JavaScript code that is viewed… Full details
MEDIUM 5.4
CVE-2019-17229 February 24, 2020
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues. Full details
MEDIUM 6.1
CVE-2019-17228 February 24, 2020
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes. Full details
MEDIUM 6.5
CVE-2020-9003 February 20, 2020
A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary JavaScript code that is viewed… Full details
MEDIUM 5.4
CVE-2013-4454 February 18, 2020
WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities Full details
CRITICAL 9.1
CVE-2020-9043 February 17, 2020
The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key. Full details
HIGH 8.8
CVE-2020-6850 February 17, 2020
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the… Full details
MEDIUM 6.1
CVE-2020-9006 February 17, 2020
The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation… Full details
CRITICAL 9.8
CVE-2020-8594 February 14, 2020
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format]. Full details
MEDIUM 5.4
CVE-2013-1401 February 13, 2020
Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll. Full details
CRITICAL 9.8
CVE-2013-1400 February 13, 2020
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs action. Full details
CRITICAL 9.8
CVE-2013-2010 February 12, 2020
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability Full details
CRITICAL 9.8
CVE-2013-5988 February 11, 2020
A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter. Full details
MEDIUM 6.1
CVE-2013-3684 February 11, 2020
NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload Full details
CRITICAL 9.8
CVE-2020-8596 February 11, 2020
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute… Full details
HIGH 7.5
CVE-2015-2062 February 8, 2020
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popup_posts or edit_cat action in the… Full details
HIGH 7.2
CVE-2014-8739 February 8, 2020
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before… Full details
CRITICAL 9.8
CVE-2015-1394 February 8, 2020
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4)… Full details
MEDIUM 5.4
CVE-2020-8772 February 6, 2020
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in. Full details
CRITICAL 9.8
CVE-2020-8771 February 6, 2020
The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts. Full details
CRITICAL 9.8
CVE-2020-8658 February 6, 2020
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF… Full details
HIGH 8.8
CVE-2019-20173 February 5, 2020
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. Full details
MEDIUM 6.1
CVE-2020-8615 February 4, 2020
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors). Full details
MEDIUM 6.5
CVE-2020-8549 February 3, 2020
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens. Full details
MEDIUM 6.1
CVE-2020-8498 January 30, 2020
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with… Full details
MEDIUM 5.4
CVE-2013-4241 January 30, 2020
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4)… Full details
MEDIUM 6.1
CVE-2013-0291 January 30, 2020
NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability Full details
HIGH 7.5
CVE-2020-8426 January 28, 2020
The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user. Full details
MEDIUM 5.4