blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2015-9331 August 20, 2019
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit. Full details
HIGH 7.5
CVE-2015-9330 August 20, 2019
The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection. Full details
CRITICAL 9.8
CVE-2015-9329 August 20, 2019
The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS. Full details
MEDIUM 6.1
CVE-2015-9318 August 20, 2019
The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies. Full details
HIGH 7.5
CVE-2015-9317 August 20, 2019
The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages. Full details
MEDIUM 6.1
CVE-2019-15082 August 20, 2019
The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS. Full details
MEDIUM 6.1
CVE-2019-15116 August 16, 2019
The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging. Full details
MEDIUM 6.1
CVE-2019-15113 August 16, 2019
The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF. Full details
HIGH 8.8
CVE-2018-20973 August 16, 2019
The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion. Full details
CRITICAL 9.8
CVE-2018-20971 August 16, 2019
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan. Full details
HIGH 8.8
CVE-2017-18547 August 16, 2019
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms. Full details
HIGH 8.8
CVE-2017-18545 August 16, 2019
The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input. Full details
HIGH 7.5
CVE-2017-18543 August 16, 2019
The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations. Full details
CRITICAL 9.8
CVE-2017-18542 August 16, 2019
The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2015-9324 August 16, 2019
The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection. Full details
CRITICAL 9.8
CVE-2015-9323 August 16, 2019
The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection. Full details
CRITICAL 9.8
CVE-2015-9322 August 16, 2019
The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF. Full details
HIGH 8.8
CVE-2014-10376 August 16, 2019
The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection. Full details
CRITICAL 9.8
CVE-2015-9326 August 16, 2019
The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection. Full details
CRITICAL 9.8
CVE-2015-9325 August 16, 2019
The visitors-online plugin before 0.4 for WordPress has SQL injection. Full details
CRITICAL 9.8
CVE-2019-14789 August 15, 2019
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter. Full details
MEDIUM 6.1
CVE-2019-14788 August 15, 2019
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value. Full details
HIGH 8.8
CVE-2019-14786 August 15, 2019
The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter. Full details
MEDIUM 6.5
CVE-2019-14784 August 15, 2019
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition. Full details
MEDIUM 6.1
CVE-2019-13578 August 15, 2019
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system… Full details
CRITICAL 9.8
CVE-2019-14800 August 15, 2019
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI. Full details
MEDIUM 5.3
CVE-2019-14795 August 15, 2019
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter. Full details
MEDIUM 4.8
CVE-2019-14790 August 15, 2019
The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter, Full details
MEDIUM 6.1
CVE-2019-14216 August 14, 2019
An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a .php file. Full details
HIGH 8.8
CVE-2017-18513 August 14, 2019
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface. Full details
HIGH 8.8
CVE-2017-18510 August 14, 2019
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions. Full details
HIGH 8.8
CVE-2016-10888 August 14, 2019
The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues. Full details
CRITICAL 9.8
CVE-2016-10887 August 14, 2019
The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues. Full details
CRITICAL 9.8
CVE-2016-10886 August 14, 2019
The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions. Full details
CRITICAL 9.8