blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2014-4519 December 27, 2019
Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the 'page' parameter. Full details
MEDIUM 6.1
CVE-2014-4559 December 27, 2019
Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) api_key,… Full details
MEDIUM 6.1
CVE-2014-4525 December 27, 2019
Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in the Ebay Feeds for WordPress plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter. Full details
MEDIUM 6.1
CVE-2014-4523 December 27, 2019
Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. Full details
MEDIUM 6.1
CVE-2019-20043 December 27, 2019
In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For… Full details
MEDIUM 4.3
CVE-2019-20042 December 27, 2019
In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along… Full details
MEDIUM 6.1
CVE-2019-20041 December 27, 2019
wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring. Full details
CRITICAL 9.8
CVE-2013-2011 December 26, 2019
WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009. Full details
HIGH 8.8
CVE-2019-16781 December 26, 2019
In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected… Full details
MEDIUM 5.4
CVE-2019-16780 December 26, 2019
WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens… Full details
MEDIUM 5.4
CVE-2019-19542 December 26, 2019
The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page. Full details
MEDIUM 5.4
CVE-2019-19541 December 26, 2019
The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page. Full details
MEDIUM 5.4
CVE-2019-19540 December 26, 2019
The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage. Full details
MEDIUM 6.1
CVE-2019-19985 December 26, 2019
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure. Full details
MEDIUM 5.3
CVE-2019-19984 December 26, 2019
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and email campaigns. Full details
MEDIUM 6.3
CVE-2019-19983 December 26, 2019
In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be… Full details
MEDIUM 4.3
CVE-2019-19982 December 26, 2019
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?es_skip=1&option_name= request. Full details
MEDIUM 5.3
CVE-2019-19981 December 26, 2019
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings. Full details
MEDIUM 5.4
CVE-2019-19980 December 26, 2019
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access) to send test emails from the administrative dashboard on behalf of an… Full details
MEDIUM 4.3
CVE-2019-19979 December 26, 2019
A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affecting site visitors. There was CSRF with resultant XSS. Full details
HIGH 8.8
CVE-2019-19915 December 19, 2019
The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete… Full details
CRITICAL 9
CVE-2019-17599 December 13, 2019
The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the… Full details
MEDIUM 6.1
CVE-2013-5978 December 11, 2019
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price… Full details
MEDIUM 6.1
CVE-2019-19589 December 5, 2019
The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued that "The vulnerability reported in PDF Embedder… Full details
CRITICAL 9.8
CVE-2019-19133 December 4, 2019
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue… Full details
MEDIUM 6.1
CVE-2019-19306 November 26, 2019
The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName. Full details
MEDIUM 5.4
CVE-2015-9539 November 26, 2019
The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS. Full details
MEDIUM 6.1
CVE-2015-9538 November 26, 2019
The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection. Full details
MEDIUM 6.5
CVE-2015-9537 November 26, 2019
The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template. Full details
MEDIUM 5.4
CVE-2019-14467 November 18, 2019
The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album, because the file extension is not checked. Full details
HIGH 7.8
CVE-2019-17550 November 13, 2019
The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the b2s_id parameter. The component is:… Full details
MEDIUM 6.1
CVE-2019-17515 November 13, 2019
The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter.… Full details
MEDIUM 6.1
CVE-2019-14366 November 12, 2019
WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.). Full details
HIGH 7.5
CVE-2019-14365 November 12, 2019
The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.). Full details
HIGH 7.5
CVE-2019-17237 November 12, 2019
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF. Full details
HIGH 8.8
CVE-2019-17236 November 12, 2019
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS. Full details
MEDIUM 6.1
CVE-2019-17235 November 12, 2019
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure. Full details
MEDIUM 5.3
CVE-2019-17234 November 12, 2019
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion. Full details
HIGH 7.5
CVE-2019-18855 November 11, 2019
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes. Full details
HIGH 7.5
CVE-2019-18854 November 11, 2019
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '' substring. Full details
HIGH 7.5
CVE-2019-17661 November 8, 2019
A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an… Full details
HIGH 8.8
CVE-2014-9014 November 6, 2019
Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote authenticated users to download arbitrary files via a .. (dot dot) in the file… Full details
MEDIUM 4.3
CVE-2014-9013 November 6, 2019
The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target… Full details
HIGH 8.8
CVE-2018-20853 November 6, 2019
An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. The plugin is vulnerable to SPAM attacks. Full details
MEDIUM 5.3
CVE-2019-16251 October 31, 2019
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Full details
MEDIUM 4.3
CVE-2015-9524 October 23, 2019
The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has… Full details
MEDIUM 6.1
CVE-2015-9523 October 23, 2019
The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has… Full details
MEDIUM 6.1
CVE-2015-9522 October 23, 2019
The Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has… Full details
MEDIUM 6.1