blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2019-16118 September 8, 2019
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php. Full details
MEDIUM 6.1
CVE-2019-16117 September 8, 2019
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php. Full details
MEDIUM 6.1
CVE-2019-14470 September 4, 2019
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter. Full details
MEDIUM 6.1
CVE-2019-15889 September 3, 2019
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter. Full details
MEDIUM 6.1
CVE-2019-15873 September 3, 2019
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html= Full details
HIGH 8.8
CVE-2019-15872 September 3, 2019
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings. Full details
CRITICAL 9.8
CVE-2019-15871 September 3, 2019
The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings. Full details
MEDIUM 4.3
CVE-2019-15870 September 3, 2019
The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field. Full details
MEDIUM 5.4
CVE-2019-15867 September 3, 2019
The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX action. Full details
HIGH 8.8
CVE-2019-15866 September 3, 2019
The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider. Full details
HIGH 8.8
CVE-2019-15863 September 3, 2019
The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants. Full details
HIGH 7.5
CVE-2019-15858 September 3, 2019
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution. Full details
HIGH 8.8
CVE-2019-15842 August 30, 2019
The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS. Full details
MEDIUM 6.1
CVE-2019-15841 August 30, 2019
The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility. Full details
HIGH 8.8
CVE-2019-15839 August 30, 2019
The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion. Full details
HIGH 7.5
CVE-2019-15838 August 30, 2019
The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789. Full details
MEDIUM 6.1
CVE-2019-15836 August 30, 2019
The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS. Full details
MEDIUM 5.4
CVE-2019-15833 August 30, 2019
The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS. Full details
MEDIUM 6.1
CVE-2019-15832 August 30, 2019
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF. Full details
HIGH 8.8
CVE-2019-15831 August 30, 2019
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page. Full details
HIGH 8.8
CVE-2019-15829 August 30, 2019
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS. Full details
MEDIUM 4.8
CVE-2019-15827 August 30, 2019
The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter. Full details
MEDIUM 5.4
CVE-2019-15826 August 30, 2019
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field. Full details
CRITICAL 9.8
CVE-2019-15825 August 30, 2019
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass. Full details
CRITICAL 9.8
CVE-2019-15824 August 30, 2019
The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass. Full details
CRITICAL 9.8
CVE-2019-15823 August 30, 2019
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass. Full details
CRITICAL 9.8
CVE-2019-15822 August 30, 2019
The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal. Full details
CRITICAL 9.8
CVE-2019-15821 August 30, 2019
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data. Full details
HIGH 7.5
CVE-2019-15820 August 30, 2019
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication. Full details
MEDIUM 6.1
CVE-2019-15819 August 30, 2019
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication. Full details
CRITICAL 9.8
CVE-2019-15818 August 30, 2019
The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist. Full details
MEDIUM 6.1
CVE-2019-15816 August 30, 2019
The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions. Full details
HIGH 7.5
CVE-2019-14979 August 29, 2019
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price.… Full details
MEDIUM 5.3
CVE-2019-14978 August 29, 2019
/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for lower than the intended price. Full details
MEDIUM 5.3
CVE-2019-15779 August 29, 2019
The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete. Full details
HIGH 8.8
CVE-2019-15771 August 29, 2019
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. Full details
MEDIUM 6.1