blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2019-15780 August 29, 2019
The formidable plugin before 4.02.01 for WordPress has unsafe deserialization. Full details
CRITICAL 9.8
CVE-2019-15777 August 29, 2019
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS. Full details
MEDIUM 5.4
CVE-2019-15776 August 29, 2019
The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file. Full details
MEDIUM 6.1
CVE-2019-15775 August 29, 2019
The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. Full details
MEDIUM 6.1
CVE-2019-15774 August 29, 2019
The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. Full details
MEDIUM 6.1
CVE-2019-15773 August 29, 2019
The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. Full details
MEDIUM 6.1
CVE-2019-15772 August 29, 2019
The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. Full details
MEDIUM 6.1
CVE-2019-15770 August 29, 2019
The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks. Full details
HIGH 8.8
CVE-2019-15769 August 29, 2019
The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option. Full details
HIGH 8.8
CVE-2018-21007 August 29, 2019
The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads. Full details
CRITICAL 9.8
CVE-2015-9359 August 28, 2019
The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9379 August 28, 2019
iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9378 August 28, 2019
iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9377 August 28, 2019
iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9376 August 28, 2019
iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9375 August 28, 2019
Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9374 August 28, 2019
Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9373 August 28, 2019
PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9372 August 28, 2019
Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9371 August 28, 2019
Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9370 August 28, 2019
Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9369 August 28, 2019
Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2017-18593 August 28, 2019
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file. Full details
MEDIUM 6.1
CVE-2015-9368 August 28, 2019
Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9367 August 28, 2019
Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9366 August 28, 2019
Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9365 August 28, 2019
Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9364 August 28, 2019
2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9363 August 28, 2019
iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9362 August 28, 2019
The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9361 August 28, 2019
The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9360 August 28, 2019
The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9358 August 28, 2019
The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg(). Full details
MEDIUM 6.1
CVE-2015-9356 August 28, 2019
The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460. Full details
MEDIUM 6.1
CVE-2015-9355 August 28, 2019
The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area. Full details
MEDIUM 6.1
CVE-2015-9353 August 28, 2019
The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066. Full details
HIGH 7.2
CVE-2012-6718 August 28, 2019
The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491. Full details
MEDIUM 6.1
CVE-2012-6717 August 28, 2019
The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562. Full details
MEDIUM 6.1
CVE-2011-5329 August 28, 2019
The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562. Full details
MEDIUM 6.1
CVE-2019-14314 August 27, 2019
A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system… Full details
CRITICAL 9.8
CVE-2019-15650 August 27, 2019
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme updates) because of a nonce check error. Full details
MEDIUM 4.3
CVE-2017-18592 August 27, 2019
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads. Full details
HIGH 7.5
CVE-2016-10936 August 27, 2019
The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option. Full details
MEDIUM 6.1