blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2019-7299 March 21, 2019
A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the… Full details
MEDIUM 6.1
CVE-2018-20556 March 21, 2019
SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the booking_id parameter. Full details
HIGH 8.8
CVE-2018-20555 March 21, 2019
The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_secret, consumer_key, and consumer_secret values by reading the dcwp_twitter.php source code. This leads to Twitter account takeover. Full details
CRITICAL 9.8
CVE-2018-19488 March 21, 2019
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's… Full details
CRITICAL 9.8
CVE-2018-19487 March 21, 2019
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users. Full details
HIGH 7.5
CVE-2019-9787 March 14, 2019
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of… Full details
HIGH 8.8
CVE-2019-9646 March 10, 2019
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area." Full details
MEDIUM 6.1
CVE-2019-9576 March 5, 2019
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. Full details
MEDIUM 6.1
CVE-2019-9575 March 5, 2019
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS. Full details
MEDIUM 6.1
CVE-2019-9574 March 5, 2019
The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role. Full details
HIGH 7.5
CVE-2019-9573 March 5, 2019
The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications. Full details
HIGH 7.5
CVE-2019-9568 March 4, 2019
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] parameter if the attacker has the delete permission. Full details
MEDIUM 6.5
CVE-2019-9567 March 4, 2019
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll. Full details
MEDIUM 6.1
CVE-2019-8943 February 20, 2019
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and… Full details
MEDIUM 6.5
CVE-2019-8942 February 20, 2019
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker… Full details
HIGH 8.8
CVE-2015-4617 February 15, 2019
Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating files outside of the upload directory. Full details
HIGH 7.5
CVE-2015-4615 February 15, 2019
Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML,mapID variables Full details
CRITICAL 9.8
CVE-2019-7413 February 5, 2019
In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via the title text. ("parallax" has a spelling change within the PHP filename.) Full details
MEDIUM 6.1
CVE-2019-7412 February 5, 2019
The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values. Full details
CRITICAL 9.8
CVE-2019-1000003 February 4, 2019
MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker can modify post data, including embedding javascript. This attack appears to… Full details
HIGH 8.8
CVE-2018-19043 January 31, 2019
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the dir parameter of an mrelocator_rename action to the wp-admin/admin-ajax.php… Full details
MEDIUM 5.3
CVE-2018-19042 January 31, 2019
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mrelocator_move action to the wp-admin/admin-ajax.php URI. Full details
MEDIUM 5.3
CVE-2018-19041 January 31, 2019
The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI. Full details
MEDIUM 6.1
CVE-2018-19040 January 31, 2019
The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI. Full details
MEDIUM 5.3
CVE-2019-6703 January 27, 2019
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests… Full details
CRITICAL 9.8
CVE-2019-6780 January 24, 2019
The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrer. Full details
MEDIUM 6.1
CVE-2018-20714 January 15, 2019
The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of woocommerce.php, which leads to certain privilege checks not being in place,… Full details
HIGH 8.1
CVE-2017-18356 January 15, 2019
In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then… Full details
HIGH 8.8
CVE-2019-6267 January 15, 2019
The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI. Full details
MEDIUM 6.1
CVE-2018-16206 January 13, 2019
Cross-site scripting vulnerability in WordPress plugin spam-byebye 2.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Full details
MEDIUM 6.1
CVE-2016-10736 January 9, 2019
The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter. Full details
MEDIUM 6.1
CVE-2018-20463 December 25, 2018
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. This can also be used… Full details
HIGH 7.5
CVE-2018-20462 December 25, 2018
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter. Full details
MEDIUM 6.1
CVE-2018-20368 December 23, 2018
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback. Full details
MEDIUM 5.4
CVE-2018-14846 December 20, 2018
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php. Full details
MEDIUM 5.4
CVE-2018-20231 December 19, 2018
Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation. Full details
HIGH 8.8
CVE-2018-20156 December 14, 2018
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multisite network. Full details
HIGH 7.2
CVE-2018-20155 December 14, 2018
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings. Full details
MEDIUM 4.3
CVE-2018-20154 December 14, 2018
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses. Full details
MEDIUM 4.3
CVE-2018-20153 December 14, 2018
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS. Full details
MEDIUM 5.4
CVE-2018-20152 December 14, 2018
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input. Full details
MEDIUM 6.5
CVE-2018-20151 December 14, 2018
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display… Full details
HIGH 7.5
CVE-2018-20150 December 14, 2018
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. Full details
MEDIUM 6.1
CVE-2018-20149 December 14, 2018
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg… Full details
MEDIUM 5.4
CVE-2018-20148 December 14, 2018
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs… Full details
CRITICAL 9.8
CVE-2018-20147 December 14, 2018
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. Full details
MEDIUM 6.5
CVE-2018-20101 December 12, 2018
The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell. Full details
MEDIUM 6.1
CVE-2018-1002009 December 3, 2018
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in unsubscribe.html.php:3: via GET reuqest to the email… Full details
MEDIUM 4.8
CVE-2018-1002008 December 3, 2018
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in list-user.html.php:4: via GET request offset variable. Full details
MEDIUM 4.8
CVE-2018-1002007 December 3, 2018
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable html_id. Full details
MEDIUM 4.8