blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2015-9410 September 26, 2019
The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter. Full details
MEDIUM 5.4
CVE-2015-9409 September 25, 2019
The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php. Full details
MEDIUM 6.5
CVE-2015-9406 September 20, 2019
Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php. Full details
HIGH 7.5
CVE-2014-10397 September 20, 2019
The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php. Full details
HIGH 7.5
CVE-2014-10396 September 20, 2019
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php. Full details
HIGH 7.5
CVE-2015-9408 September 20, 2019
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS. Full details
MEDIUM 6.5
CVE-2015-9407 September 20, 2019
The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS. Full details
MEDIUM 6.1
CVE-2015-9404 September 20, 2019
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS. Full details
MEDIUM 6.1
CVE-2015-9403 September 20, 2019
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS. Full details
MEDIUM 6.1
CVE-2015-9402 September 20, 2019
The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload. Full details
HIGH 8.8
CVE-2015-9401 September 20, 2019
The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS. Full details
MEDIUM 4.8
CVE-2015-9400 September 20, 2019
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection. Full details
HIGH 8.8
CVE-2015-9399 September 20, 2019
The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection. Full details
HIGH 7.2
CVE-2015-9398 September 20, 2019
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection. Full details
HIGH 8.8
CVE-2015-9397 September 20, 2019
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS. Full details
MEDIUM 5.4
CVE-2015-9396 September 20, 2019
The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS. Full details
MEDIUM 6.1
CVE-2015-9395 September 20, 2019
The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action. Full details
HIGH 8.8
CVE-2015-9394 September 20, 2019
The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php. Full details
HIGH 8.8
CVE-2015-9393 September 20, 2019
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter. Full details
MEDIUM 5.4
CVE-2015-9392 September 20, 2019
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter. Full details
MEDIUM 5.4
CVE-2016-11013 September 20, 2019
The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS. Full details
MEDIUM 6.1
CVE-2016-11012 September 20, 2019
The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS. Full details
MEDIUM 5.4
CVE-2016-11011 September 20, 2019
The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation. Full details
MEDIUM 6.5
CVE-2016-11010 September 20, 2019
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates. Full details
MEDIUM 5.3
CVE-2016-11009 September 20, 2019
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates. Full details
MEDIUM 5.3
CVE-2016-11008 September 20, 2019
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates. Full details
MEDIUM 5.3
CVE-2016-11007 September 20, 2019
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval. Full details
MEDIUM 5.3
CVE-2016-11006 September 20, 2019
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes. Full details
MEDIUM 5.3
CVE-2016-11005 September 20, 2019
The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS. Full details
MEDIUM 6.1
CVE-2016-11004 September 20, 2019
The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation. Full details
HIGH 8.8
CVE-2016-11003 September 20, 2019
The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation. Full details
HIGH 8.8
CVE-2016-11002 September 20, 2019
The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation. Full details
HIGH 8.8
CVE-2016-11001 September 20, 2019
The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field. Full details
MEDIUM 6.1
CVE-2016-11000 September 20, 2019
The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter. Full details
CRITICAL 9.8
CVE-2016-10999 September 20, 2019
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter. Full details
MEDIUM 6.1
CVE-2016-10998 September 20, 2019
The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS. Full details
MEDIUM 6.1
CVE-2016-10997 September 20, 2019
The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php. Full details
MEDIUM 6.5
CVE-2016-10996 September 20, 2019
The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak. Full details
MEDIUM 5.3
CVE-2015-9391 September 20, 2019
The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter. Full details
MEDIUM 6.1
CVE-2015-9390 September 20, 2019
The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled. Full details
MEDIUM 4.3
CVE-2015-9389 September 20, 2019
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name. Full details
MEDIUM 5.4
CVE-2015-9388 September 20, 2019
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS. Full details
MEDIUM 6.5
CVE-2015-9387 September 20, 2019
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF. Full details
MEDIUM 6.5
CVE-2015-9386 September 20, 2019
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation. Full details
MEDIUM 6.1
CVE-2019-16525 September 19, 2019
An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code. Full details
MEDIUM 6.1
CVE-2016-10995 September 18, 2019
The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php. Full details
CRITICAL 9.8