blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2019-16522 October 16, 2019
The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent… Full details
MEDIUM 4.8
CVE-2019-16521 October 16, 2019
The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the… Full details
MEDIUM 6.1
CVE-2019-16520 October 16, 2019
The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific description for posts provided by the plugin via unsafe… Full details
MEDIUM 5.4
CVE-2019-17574 October 14, 2019
An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated… Full details
CRITICAL 9.1
CVE-2015-9492 October 11, 2019
The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. Full details
HIGH 7.5
CVE-2015-9491 October 11, 2019
The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. Full details
HIGH 7.5
CVE-2015-9490 October 11, 2019
The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. Full details
HIGH 7.5
CVE-2015-9489 October 11, 2019
The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. Full details
HIGH 7.5
CVE-2015-9488 October 11, 2019
The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. Full details
HIGH 7.5
CVE-2015-9487 October 11, 2019
The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. Full details
HIGH 7.5
CVE-2015-9486 October 11, 2019
The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. Full details
HIGH 7.5
CVE-2015-9485 October 11, 2019
The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the… Full details
HIGH 7.5
CVE-2015-9484 October 11, 2019
The ThemeMakers Accio One Page Parallax Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. Full details
HIGH 7.5
CVE-2015-9483 October 11, 2019
The ThemeMakers Invento Responsive Gallery/Architecture Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. Full details
HIGH 7.5
CVE-2015-9482 October 11, 2019
The ThemeMakers Car Dealer / Auto Dealer Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat… Full details
HIGH 7.5
CVE-2015-9481 October 11, 2019
The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI. Full details
HIGH 7.5
CVE-2019-17386 October 10, 2019
The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php. Full details
HIGH 8.8
CVE-2015-9480 October 10, 2019
The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter. Full details
HIGH 7.5
CVE-2015-9479 October 10, 2019
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php. Full details
CRITICAL 9.8
CVE-2015-9477 October 10, 2019
The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates. Full details
HIGH 8.8
CVE-2015-9476 October 10, 2019
The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates. Full details
HIGH 8.8
CVE-2015-9475 October 10, 2019
The Pont theme 1.5 for WordPress has insufficient restrictions on option updates. Full details
HIGH 8.8
CVE-2015-9474 October 10, 2019
The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates. Full details
HIGH 8.8
CVE-2015-9473 October 10, 2019
The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter. Full details
HIGH 7.5
CVE-2015-9472 October 10, 2019
The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header. Full details
MEDIUM 6.1
CVE-2015-9471 October 10, 2019
The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload. Full details
CRITICAL 9.8
CVE-2015-9470 October 10, 2019
The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter. Full details
HIGH 7.5
CVE-2015-9469 October 10, 2019
The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id. Full details
MEDIUM 4.8
CVE-2015-9468 October 10, 2019
The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action. Full details
MEDIUM 6.1
CVE-2015-9467 October 10, 2019
The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter. Full details
CRITICAL 9.8
CVE-2015-9466 October 10, 2019
The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, or HTTP_FORWARDED variable. Full details
CRITICAL 9.8
CVE-2015-9465 October 10, 2019
The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter. Full details
HIGH 8.8
CVE-2015-9463 October 10, 2019
The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter. Full details
HIGH 7.5
CVE-2015-9464 October 10, 2019
The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter. Full details
HIGH 7.5
CVE-2015-9462 October 10, 2019
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_category_page SQL injection via the cat_id parameter. Full details
HIGH 7.2
CVE-2015-9461 October 10, 2019
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_portfolio_item_page SQL injection via the item_id parameter. Full details
HIGH 7.2
CVE-2015-9460 October 10, 2019
The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter. Full details
HIGH 8.8
CVE-2015-9459 October 10, 2019
The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter. Full details
MEDIUM 6.1
CVE-2015-9458 October 10, 2019
The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms count parameter exploitable via CSRF. Full details
HIGH 7.2
CVE-2015-9457 October 10, 2019
The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter. Full details
HIGH 7.2
CVE-2019-17072 October 10, 2019
The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php. Full details
CRITICAL 9.8
CVE-2019-17071 October 10, 2019
The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS. Full details
MEDIUM 6.1
CVE-2019-17070 October 10, 2019
The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer. Full details
MEDIUM 6.1
CVE-2019-17233 October 7, 2019
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. Full details
MEDIUM 6.1
CVE-2019-17232 October 7, 2019
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import. Full details
HIGH 7.5
CVE-2019-17239 October 7, 2019
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues. Full details
MEDIUM 6.1
CVE-2015-9456 October 7, 2019
The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter. Full details
MEDIUM 6.5
CVE-2015-9455 October 7, 2019
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action. Full details
HIGH 8.1