blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2016-10993 September 17, 2019
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter. Full details
MEDIUM 5.4
CVE-2016-10992 September 17, 2019
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter. Full details
MEDIUM 6.1
CVE-2016-10991 September 17, 2019
The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion. Full details
HIGH 7.5
CVE-2016-10990 September 17, 2019
The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header. Full details
MEDIUM 6.1
CVE-2016-10989 September 17, 2019
The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF. Full details
HIGH 8.8
CVE-2016-10988 September 17, 2019
The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer. Full details
MEDIUM 6.1
CVE-2016-10987 September 17, 2019
The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS. Full details
MEDIUM 6.1
CVE-2016-10986 September 17, 2019
The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret. Full details
MEDIUM 6.1
CVE-2016-10985 September 17, 2019
The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter. Full details
MEDIUM 6.1
CVE-2016-10984 September 17, 2019
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. Full details
MEDIUM 6.1
CVE-2016-10983 September 17, 2019
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data. Full details
MEDIUM 6.5
CVE-2016-10982 September 17, 2019
The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF. Full details
HIGH 8.8
CVE-2016-10981 September 17, 2019
The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text. Full details
MEDIUM 6.1
CVE-2016-10980 September 17, 2019
The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo. Full details
MEDIUM 6.1
CVE-2016-10977 September 17, 2019
The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal. Full details
MEDIUM 6.5
CVE-2016-10976 September 17, 2019
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS. Full details
MEDIUM 6.1
CVE-2016-10975 September 17, 2019
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter. Full details
MEDIUM 6.1
CVE-2016-10974 September 17, 2019
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS. Full details
HIGH 8.8
CVE-2016-10973 September 16, 2019
The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php. Full details
MEDIUM 6.1
CVE-2016-10972 September 16, 2019
The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel. Full details
CRITICAL 9.8
CVE-2016-10971 September 16, 2019
The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required. Full details
CRITICAL 9.8
CVE-2016-10970 September 16, 2019
The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt. Full details
MEDIUM 6.1
CVE-2016-10969 September 16, 2019
The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title. Full details
MEDIUM 6.1
CVE-2016-10968 September 16, 2019
The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation. Full details
HIGH 8.8
CVE-2016-10967 September 16, 2019
The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter. Full details
MEDIUM 6.1
CVE-2016-10966 September 16, 2019
The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload. Full details
HIGH 7.5
CVE-2016-10965 September 16, 2019
The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion. Full details
HIGH 7.5
CVE-2016-10964 September 16, 2019
The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header. Full details
MEDIUM 6.1
CVE-2016-10962 September 16, 2019
The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter. Full details
MEDIUM 6.5
CVE-2016-10961 September 16, 2019
The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter. Full details
MEDIUM 6.1
CVE-2016-10960 September 16, 2019
The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter. Full details
HIGH 8.8
CVE-2016-10959 September 16, 2019
The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php. Full details
MEDIUM 6.5
CVE-2016-10958 September 16, 2019
The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php. Full details
HIGH 7.5
CVE-2016-10957 September 16, 2019
The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter. Full details
MEDIUM 6.1
CVE-2017-18634 September 16, 2019
The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php. Full details
CRITICAL 9.8
CVE-2016-10956 September 16, 2019
The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php. Full details
HIGH 7.5
CVE-2019-16332 September 15, 2019
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS. Full details
MEDIUM 6.1
CVE-2019-16289 September 13, 2019
The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter. Full details
MEDIUM 5.4
CVE-2019-12517 September 13, 2019
An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database… Full details
MEDIUM 6.1
CVE-2019-12516 September 13, 2019
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI. Full details
HIGH 8.8
CVE-2016-10955 September 13, 2019
The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking. Full details
CRITICAL 9.8
CVE-2016-10954 September 13, 2019
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload. Full details
CRITICAL 9.8
CVE-2016-10953 September 13, 2019
The Headway theme before 3.8.9 for WordPress has XSS via the license key field. Full details
MEDIUM 5.4
CVE-2016-10952 September 13, 2019
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter. Full details
MEDIUM 6.1
CVE-2016-10951 September 13, 2019
The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter. Full details
HIGH 7.2
CVE-2016-10950 September 13, 2019
The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter. Full details
HIGH 8.8