blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2015-9351 August 27, 2019
The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button. Full details
CRITICAL 9.8
CVE-2015-9350 August 27, 2019
The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button. Full details
MEDIUM 6.1
CVE-2015-9348 August 27, 2019
The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs. Full details
HIGH 7.5
CVE-2019-15659 August 27, 2019
The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969. Full details
CRITICAL 9.8
CVE-2019-15649 August 27, 2019
The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload. Full details
HIGH 8.8
CVE-2019-15648 August 27, 2019
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber. Full details
MEDIUM 6.5
CVE-2019-15647 August 27, 2019
The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution. Full details
HIGH 8.8
CVE-2018-21005 August 27, 2019
The bbp-move-topics plugin before 1.1.6 for WordPress has code injection. Full details
CRITICAL 9.8
CVE-2016-10935 August 27, 2019
The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation. Full details
CRITICAL 9.8
CVE-2015-9349 August 27, 2019
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser. Full details
MEDIUM 6.1
CVE-2015-9345 August 27, 2019
The link-log plugin before 2.0 for WordPress has HTTP Response Splitting. Full details
HIGH 7.5
CVE-2014-10395 August 27, 2019
The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list. Full details
MEDIUM 6.1
CVE-2019-15092 August 23, 2019
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class. Full details
HIGH 7.3
CVE-2019-15329 August 22, 2019
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF. Full details
HIGH 8.8
CVE-2019-15328 August 22, 2019
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS. Full details
MEDIUM 6.1
CVE-2019-15327 August 22, 2019
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data. Full details
MEDIUM 6.1
CVE-2019-15326 August 22, 2019
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal. Full details
HIGH 7.5
CVE-2018-20987 August 22, 2019
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection. Full details
CRITICAL 9.8
CVE-2018-20986 August 22, 2019
The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors. Full details
MEDIUM 5.4
CVE-2017-18585 August 22, 2019
The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal. Full details
HIGH 8.1
CVE-2016-10929 August 22, 2019
The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in. Full details
MEDIUM 5.3
CVE-2016-10928 August 22, 2019
The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users. Full details
HIGH 7.5
CVE-2015-9340 August 22, 2019
The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files. Full details
HIGH 7.5
CVE-2015-9339 August 22, 2019
The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files. Full details
HIGH 7.5
CVE-2015-9338 August 22, 2019
The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files. Full details
HIGH 7.5
CVE-2015-9334 August 22, 2019
The email-newsletter plugin through 20.15 for WordPress has SQL injection. Full details
CRITICAL 9.8
CVE-2014-10386 August 22, 2019
The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections. Full details
MEDIUM 6.1
CVE-2014-10382 August 22, 2019
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment. Full details
MEDIUM 4.3
CVE-2013-7483 August 22, 2019
The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion. Full details
CRITICAL 9.8
CVE-2019-15331 August 22, 2019
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection. Full details
MEDIUM 6.1
CVE-2019-15330 August 22, 2019
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading. Full details
HIGH 7.5