blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2016-10949 September 13, 2019
The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization. Full details
HIGH 8.8
CVE-2016-10948 September 13, 2019
The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function. Full details
HIGH 8.1
CVE-2016-10947 September 13, 2019
The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin. Full details
HIGH 7.2
CVE-2017-18614 September 13, 2019
The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter. Full details
HIGH 8.1
CVE-2017-18613 September 13, 2019
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter. Full details
MEDIUM 6.1
CVE-2017-18612 September 13, 2019
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter. Full details
MEDIUM 6.1
CVE-2016-10945 September 13, 2019
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF. Full details
HIGH 8.8
CVE-2016-10944 September 13, 2019
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF. Full details
HIGH 8.8
CVE-2016-10943 September 13, 2019
The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter. Full details
HIGH 7.2
CVE-2016-10942 September 13, 2019
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF. Full details
CRITICAL 9.8
CVE-2016-10941 September 13, 2019
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF. Full details
MEDIUM 6.1
CVE-2016-10940 September 13, 2019
The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter. Full details
HIGH 7.2
CVE-2016-10939 September 13, 2019
The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter. Full details
HIGH 7.2
CVE-2016-10938 September 13, 2019
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location. Full details
MEDIUM 6.5
CVE-2019-5992 September 12, 2019
Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors. Full details
HIGH 8.8
CVE-2019-16250 September 11, 2019
includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence. Full details
HIGH 7.5
CVE-2019-14936 September 11, 2019
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). Full details
MEDIUM 5.3
CVE-2019-16223 September 11, 2019
WordPress before 5.2.3 allows XSS in post previews by authenticated users. Full details
MEDIUM 5.4
CVE-2019-16222 September 11, 2019
WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. Full details
MEDIUM 6.1
CVE-2019-16220 September 11, 2019
In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash. Full details
MEDIUM 6.1
CVE-2019-16217 September 11, 2019
WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. Full details
MEDIUM 6.1
CVE-2019-15896 September 10, 2019
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator… Full details
CRITICAL 9.8
CVE-2017-18611 September 10, 2019
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter. Full details
MEDIUM 6.1
CVE-2017-18610 September 10, 2019
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter. Full details
MEDIUM 6.1
CVE-2017-18609 September 10, 2019
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter. Full details
MEDIUM 6.1
CVE-2017-18608 September 10, 2019
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2017-18605 September 10, 2019
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection. Full details
CRITICAL 9.8
CVE-2017-18604 September 10, 2019
The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request. Full details
HIGH 7.5
CVE-2017-18603 September 10, 2019
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter. Full details
MEDIUM 6.1
CVE-2017-18602 September 10, 2019
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter. Full details
HIGH 8.8
CVE-2017-18601 September 10, 2019
The examapp plugin 1.0 for WordPress has XSS via exam input text fields. Full details
MEDIUM 5.4
CVE-2017-18600 September 10, 2019
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field. Full details
MEDIUM 5.4
CVE-2017-18599 September 10, 2019
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter. Full details
MEDIUM 6.1
CVE-2017-18598 September 10, 2019
The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php. Full details
MEDIUM 6.1
CVE-2017-18597 September 10, 2019
The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter. Full details
HIGH 8.8
CVE-2017-18596 September 10, 2019
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions. Full details
HIGH 8.8
CVE-2019-15895 September 9, 2019
search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes. Full details
HIGH 7.5
CVE-2018-21013 September 9, 2019
The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php. Full details
CRITICAL 9.8
CVE-2018-21011 September 9, 2019
The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details. Full details
HIGH 7.5
CVE-2019-16120 September 8, 2019
CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature. Full details
HIGH 8.8
CVE-2019-16119 September 8, 2019
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter. Full details
CRITICAL 9.8