blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2017-18554 August 21, 2019
The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event. Full details
MEDIUM 6.1
CVE-2016-10909 August 21, 2019
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection. Full details
CRITICAL 9.8
CVE-2016-10908 August 21, 2019
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS. Full details
MEDIUM 6.1
CVE-2016-10903 August 21, 2019
The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF. Full details
HIGH 8.8
CVE-2016-10902 August 21, 2019
The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools. Full details
HIGH 8.8
CVE-2016-10901 August 21, 2019
The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools. Full details
MEDIUM 6.1
CVE-2019-15109 August 21, 2019
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter. Full details
MEDIUM 6.1
CVE-2017-18540 August 21, 2019
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes. Full details
MEDIUM 6.1
CVE-2017-18539 August 21, 2019
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes. Full details
MEDIUM 6.1
CVE-2017-18538 August 21, 2019
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes. Full details
MEDIUM 6.1
CVE-2017-18537 August 21, 2019
The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2017-18534 August 21, 2019
The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters. Full details
MEDIUM 6.1
CVE-2016-10899 August 21, 2019
The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability. Full details
MEDIUM 5.3
CVE-2016-10897 August 21, 2019
The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2015-9321 August 21, 2019
The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg. Full details
MEDIUM 6.1
CVE-2017-18531 August 20, 2019
The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288. Full details
MEDIUM 6.1
CVE-2017-18527 August 20, 2019
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2017-18524 August 20, 2019
The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2017-18523 August 20, 2019
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book. Full details
HIGH 8.8
CVE-2017-18522 August 20, 2019
The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book. Full details
MEDIUM 6.1
CVE-2017-18519 August 20, 2019
The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages. Full details
MEDIUM 6.1
CVE-2016-10895 August 20, 2019
The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request. Full details
MEDIUM 6.1
CVE-2016-10892 August 20, 2019
The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2015-9320 August 20, 2019
The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg. Full details
MEDIUM 6.1
CVE-2015-9319 August 20, 2019
The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser. Full details
MEDIUM 6.1
CVE-2019-15238 August 20, 2019
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field. Full details
HIGH 8.8
CVE-2017-18520 August 20, 2019
The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php. Full details
MEDIUM 6.1
CVE-2017-18517 August 20, 2019
The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2016-10914 August 20, 2019
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file. Full details
HIGH 8.8
CVE-2016-10893 August 20, 2019
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests. Full details
MEDIUM 6.1
CVE-2015-9332 August 20, 2019
The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI. Full details
MEDIUM 6.5