blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2015-9293 August 13, 2019
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature. Full details
MEDIUM 6.1
CVE-2012-6713 August 13, 2019
The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2019-14947 August 12, 2019
The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade. Full details
MEDIUM 5.4
CVE-2019-14946 August 12, 2019
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations. Full details
MEDIUM 5.4
CVE-2018-20966 August 12, 2019
The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature. Full details
MEDIUM 6.1
CVE-2017-18502 August 12, 2019
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2017-18501 August 12, 2019
The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2017-18500 August 12, 2019
The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2016-10872 August 12, 2019
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form. Full details
MEDIUM 6.1
CVE-2015-9304 August 12, 2019
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input. Full details
MEDIUM 6.1
CVE-2015-9303 August 12, 2019
The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS. Full details
MEDIUM 6.1
CVE-2019-14950 August 12, 2019
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page. Full details
MEDIUM 6.1
CVE-2019-14948 August 12, 2019
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure. Full details
MEDIUM 5.4
CVE-2017-18506 August 12, 2019
The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens. Full details
MEDIUM 6.1
CVE-2016-10877 August 12, 2019
The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues. Full details
MEDIUM 6.1
CVE-2015-9306 August 12, 2019
The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. Full details
MEDIUM 6.1
CVE-2015-9305 August 12, 2019
The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions. Full details
MEDIUM 6.1
CVE-2019-14801 August 9, 2019
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. Full details
CRITICAL 9.8
CVE-2019-14798 August 9, 2019
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter. Full details
MEDIUM 4.9
CVE-2019-14797 August 9, 2019
The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS. Full details
MEDIUM 5.4
CVE-2019-14796 August 9, 2019
The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter. Full details
MEDIUM 5.4
CVE-2019-14794 August 9, 2019
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. Full details
HIGH 7.5
CVE-2019-14791 August 9, 2019
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter. Full details
MEDIUM 6.1
CVE-2019-14799 August 9, 2019
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. Full details
MEDIUM 6.1
CVE-2019-14793 August 9, 2019
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter. Full details
MEDIUM 6.5
CVE-2019-14792 August 9, 2019
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter. Full details
MEDIUM 5.4
CVE-2019-14787 August 9, 2019
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter. Full details
MEDIUM 5.4
CVE-2019-14785 August 9, 2019
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter. Full details
MEDIUM 5.4
CVE-2016-10865 August 9, 2019
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS. Full details
MEDIUM 6.1
CVE-2019-14774 August 8, 2019
The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter. Full details
MEDIUM 6.1
CVE-2019-14773 August 8, 2019
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion. Full details
HIGH 7.5
CVE-2019-14683 August 8, 2019
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF. Full details
MEDIUM 5.7
CVE-2019-14682 August 8, 2019
The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF. Full details
MEDIUM 4.3
CVE-2019-14681 August 8, 2019
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF. Full details
HIGH 8.8
CVE-2019-14680 August 8, 2019
The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF. Full details
MEDIUM 5.7