blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,605
Affected records46,308
Newest source updateNovember 9, 2026
CVE-2020-8417 January 28, 2020
The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu. Full details
HIGH 8.8
CVE-2015-5483 January 28, 2020
Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3)… Full details
HIGH 8.8
CVE-2013-2714 January 28, 2020
Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parameter. Full details
MEDIUM 6.1
CVE-2013-4462 January 27, 2020
WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability Full details
CRITICAL 9.1
CVE-2012-6649 January 23, 2020
WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload. Full details
CRITICAL 9.8
CVE-2014-7238 January 23, 2020
The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS Full details
MEDIUM 6.1
CVE-2012-4919 January 22, 2020
Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability Full details
CRITICAL 9.8
CVE-2020-7109 January 22, 2020
The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template. Full details
CRITICAL 9.8
CVE-2020-7228 January 22, 2020
The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user. Full details
MEDIUM 5.4
CVE-2020-6849 January 21, 2020
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS. Full details
HIGH 8.8
CVE-2016-11018 January 21, 2020
An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-Forwarded-For are prone to unauthenticated SQL injection. The affected file is gallery-images.php. The affected function is huge_it_image_gallery_ajax_callback(). Full details
CRITICAL 9.8
CVE-2020-7239 January 21, 2020
The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent. Full details
MEDIUM 6.1
CVE-2020-7241 January 20, 2020
The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings… Full details
HIGH 7.5
CVE-2020-7104 January 17, 2020
The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter. Full details
MEDIUM 6.1
CVE-2020-7048 January 16, 2020
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set-up state (deleting all site content stored… Full details
CRITICAL 9.1
CVE-2020-7047 January 16, 2020
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-admin/admin.php?db-reset-tables[]=users request) to escalate their privileges to administrator while dropping… Full details
HIGH 8.8
CVE-2020-7108 January 16, 2020
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field. Full details
MEDIUM 5.4
CVE-2020-7107 January 16, 2020
The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php. Full details
MEDIUM 6.1
CVE-2015-5484 January 15, 2020
Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via a post. Full details
MEDIUM 5.4
CVE-2019-20212 January 13, 2020
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form. Full details
MEDIUM 6.1
CVE-2019-20211 January 13, 2020
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, Job or Position, Description, Service… Full details
MEDIUM 6.1
CVE-2019-20210 January 13, 2020
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query. Full details
MEDIUM 6.1
CVE-2019-20209 January 13, 2020
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing. Full details
HIGH 7.5
CVE-2020-6859 January 13, 2020
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified user_id parameter. This… Full details
MEDIUM 5.3
CVE-2014-6059 January 13, 2020
WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability Full details
HIGH 7.2
CVE-2019-20182 January 9, 2020
The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter. Full details
MEDIUM 4.8
CVE-2019-20181 January 9, 2020
The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter. Full details
MEDIUM 4.8
CVE-2019-20180 January 9, 2020
The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and… Full details
MEDIUM 6.8
CVE-2020-6168 January 9, 2020
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings (impacting the availability and confidentiality of a vulnerable… Full details
HIGH 7.6
CVE-2020-6166 January 9, 2020
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change maintenance-mode themes. Full details
MEDIUM 5.4
CVE-2020-6167 January 9, 2020
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a… Full details
HIGH 8.8
CVE-2019-20361 January 8, 2020
There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability). Full details
CRITICAL 9.8
CVE-2019-20360 January 8, 2020
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an… Full details
HIGH 7.5
CVE-2015-4039 January 6, 2020
Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content.… Full details
MEDIUM 5.4
CVE-2014-4553 January 2, 2020
Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters. Full details
MEDIUM 6.1
CVE-2019-20204 January 2, 2020
The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element. Full details
MEDIUM 5.4
CVE-2019-20203 January 2, 2020
The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message. Full details
MEDIUM 5.3
CVE-2019-20141 December 30, 2019
An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter. Full details
MEDIUM 6.1
CVE-2014-4550 December 27, 2019
Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter. Full details
MEDIUM 6.1
CVE-2014-4536 December 27, 2019
Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or… Full details
MEDIUM 6.1
CVE-2014-4535 December 27, 2019
Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. Full details
MEDIUM 6.1
CVE-2014-4567 December 27, 2019
Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116 for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter. Full details
MEDIUM 6.1
CVE-2014-4558 December 27, 2019
Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter. Full details
MEDIUM 6.1
CVE-2014-4548 December 27, 2019
Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the popup parameter. Full details
MEDIUM 6.1
CVE-2014-4544 December 27, 2019
Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the Filename parameter to getid3/demos/demo.write.php. Full details
MEDIUM 6.1
CVE-2014-4539 December 27, 2019
Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. Full details
MEDIUM 6.1