blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2015-9454 October 7, 2019
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter. Full details
HIGH 8.8
CVE-2015-9453 October 7, 2019
The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist. Full details
MEDIUM 6.1
CVE-2015-9452 October 7, 2019
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter. Full details
CRITICAL 9.8
CVE-2015-9451 October 7, 2019
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter. Full details
CRITICAL 9.8
CVE-2015-9450 October 7, 2019
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter. Full details
CRITICAL 9.8
CVE-2018-18379 October 7, 2019
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS. Full details
MEDIUM 6.1
CVE-2019-17214 October 6, 2019
The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI. Full details
HIGH 7.5
CVE-2019-17213 October 6, 2019
The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header. Full details
MEDIUM 6.1
CVE-2019-16931 October 3, 2019
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This… Full details
MEDIUM 6.1
CVE-2019-16932 September 30, 2019
A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data. Full details
CRITICAL 10
CVE-2019-16902 September 27, 2019
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname. Full details
HIGH 7.5
CVE-2019-16524 September 26, 2019
The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is… Full details
MEDIUM 4.8
CVE-2015-9448 September 26, 2019
The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter. Full details
HIGH 8.8
CVE-2015-9447 September 26, 2019
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters. Full details
MEDIUM 6.5
CVE-2015-9446 September 26, 2019
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php. Full details
HIGH 8.8
CVE-2015-9445 September 26, 2019
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation. Full details
HIGH 8.8
CVE-2015-9444 September 26, 2019
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF. Full details
MEDIUM 6.1
CVE-2015-9443 September 26, 2019
The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP. Full details
MEDIUM 6.5
CVE-2015-9442 September 26, 2019
The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin. Full details
MEDIUM 6.5
CVE-2015-9441 September 26, 2019
The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php. Full details
MEDIUM 6.5
CVE-2015-9440 September 26, 2019
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new. Full details
MEDIUM 6.5
CVE-2015-9439 September 26, 2019
The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter. Full details
MEDIUM 4.8
CVE-2015-9438 September 26, 2019
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter. Full details
MEDIUM 5.4
CVE-2015-9437 September 26, 2019
The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter. Full details
MEDIUM 6.5
CVE-2015-9436 September 26, 2019
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter. Full details
MEDIUM 5.4
CVE-2015-9435 September 26, 2019
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers. Full details
CRITICAL 9.8
CVE-2015-9434 September 26, 2019
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter. Full details
MEDIUM 6.5
CVE-2015-9433 September 26, 2019
The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php. Full details
MEDIUM 6.5
CVE-2015-9432 September 26, 2019
The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter. Full details
MEDIUM 6.5
CVE-2015-9431 September 26, 2019
The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter. Full details
MEDIUM 6.5
CVE-2015-9449 September 26, 2019
The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter. Full details
HIGH 7.2
CVE-2015-9430 September 26, 2019
The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header. Full details
MEDIUM 6.1
CVE-2015-9429 September 26, 2019
The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter. Full details
MEDIUM 6.5
CVE-2015-9428 September 26, 2019
The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters. Full details
MEDIUM 6.5
CVE-2015-9427 September 26, 2019
The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter. Full details
MEDIUM 6.5
CVE-2015-9426 September 26, 2019
The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter. Full details
MEDIUM 4.6
CVE-2015-9425 September 26, 2019
The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter. Full details
MEDIUM 5.4
CVE-2015-9424 September 26, 2019
The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter. Full details
MEDIUM 6.5
CVE-2015-9423 September 26, 2019
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plugneditcontent parameters. Full details
MEDIUM 5.4
CVE-2015-9422 September 26, 2019
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters. Full details
MEDIUM 6.5
CVE-2015-9421 September 26, 2019
The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter. Full details
MEDIUM 6.5
CVE-2015-9420 September 26, 2019
The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter. Full details
MEDIUM 6.1
CVE-2015-9419 September 26, 2019
The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section. Full details
MEDIUM 6.1
CVE-2015-9418 September 26, 2019
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes. Full details
MEDIUM 4.3
CVE-2015-9417 September 26, 2019
The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS. Full details
MEDIUM 6.5
CVE-2015-9416 September 26, 2019
The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header. Full details
MEDIUM 6.1
CVE-2015-9415 September 26, 2019
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion. Full details
HIGH 7.5
CVE-2015-9414 September 26, 2019
The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter. Full details
MEDIUM 6.1
CVE-2015-9413 September 26, 2019
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter. Full details
MEDIUM 6.5
CVE-2015-9412 September 26, 2019
The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter. Full details
MEDIUM 6.1