blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2018-20988 August 22, 2019
The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation. Full details
HIGH 7.5
CVE-2017-18586 August 22, 2019
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths. Full details
CRITICAL 9.1
CVE-2016-10930 August 22, 2019
The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number. Full details
CRITICAL 9.8
CVE-2015-9341 August 22, 2019
The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files. Full details
HIGH 7.5
CVE-2014-10394 August 22, 2019
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header. Full details
MEDIUM 6.1
CVE-2014-10391 August 22, 2019
The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection. Full details
MEDIUM 6.1
CVE-2014-10390 August 22, 2019
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal. Full details
CRITICAL 9.1
CVE-2014-10389 August 22, 2019
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication. Full details
CRITICAL 9.8
CVE-2014-10388 August 22, 2019
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure. Full details
MEDIUM 5.3
CVE-2014-10387 August 22, 2019
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection. Full details
CRITICAL 9.8
CVE-2019-15324 August 22, 2019
The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. Full details
HIGH 8.8
CVE-2019-15322 August 22, 2019
The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion. Full details
CRITICAL 9.8
CVE-2019-15321 August 22, 2019
The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled. Full details
CRITICAL 9.8
CVE-2019-15320 August 22, 2019
The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled. Full details
CRITICAL 9.8
CVE-2019-15319 August 22, 2019
The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce. Full details
CRITICAL 9.8
CVE-2018-20985 August 22, 2019
The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec. Full details
CRITICAL 9.8
CVE-2018-20984 August 22, 2019
The patreon-connect plugin before 1.2.2 for WordPress has Object Injection. Full details
CRITICAL 9.8
CVE-2017-18584 August 22, 2019
The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action. Full details
HIGH 7.5
CVE-2017-18583 August 22, 2019
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection. Full details
CRITICAL 9.8
CVE-2017-18582 August 22, 2019
The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2017-18581 August 22, 2019
The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list. Full details
MEDIUM 6.1
CVE-2017-18580 August 22, 2019
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode. Full details
CRITICAL 9.8
CVE-2017-18577 August 22, 2019
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg. Full details
MEDIUM 6.1
CVE-2017-18576 August 22, 2019
The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation. Full details
MEDIUM 6.1
CVE-2016-10927 August 22, 2019
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php. Full details
CRITICAL 10
CVE-2016-10926 August 22, 2019
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php. Full details
CRITICAL 10
CVE-2016-10925 August 22, 2019
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs. Full details
MEDIUM 6.1
CVE-2016-10924 August 22, 2019
The ebook-download plugin before 1.2 for WordPress has directory traversal. Full details
HIGH 7.5
CVE-2016-10923 August 22, 2019
The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation. Full details
CRITICAL 9.8
CVE-2016-10922 August 22, 2019
The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation. Full details
CRITICAL 9.8
CVE-2015-9337 August 22, 2019
The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX. Full details
HIGH 7.5
CVE-2014-10385 August 22, 2019
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST. Full details
MEDIUM 6.1
CVE-2014-10384 August 22, 2019
The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion. Full details
CRITICAL 9.8
CVE-2014-10383 August 22, 2019
The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion. Full details
CRITICAL 9.8
CVE-2019-15318 August 22, 2019
The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field. Full details
CRITICAL 9.8
CVE-2018-20982 August 22, 2019
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens. Full details
MEDIUM 6.1
CVE-2018-20981 August 22, 2019
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests. Full details
CRITICAL 9.1
CVE-2018-20980 August 22, 2019
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering. Full details
HIGH 7.5
CVE-2018-20979 August 22, 2019
The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type. Full details
CRITICAL 9.8
CVE-2017-18575 August 22, 2019
The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues. Full details
MEDIUM 6.1
CVE-2017-18574 August 22, 2019
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. Full details
MEDIUM 6.1
CVE-2017-18573 August 22, 2019
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection. Full details
CRITICAL 9.8
CVE-2017-18571 August 22, 2019
The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316. Full details
CRITICAL 9.8