blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2018-1002004 December 3, 2018
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. Full details
MEDIUM 4.8
CVE-2018-1002003 December 3, 2018
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. Full details
MEDIUM 4.8
CVE-2018-1002002 December 3, 2018
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. Full details
MEDIUM 4.8
CVE-2018-1002001 December 3, 2018
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. Full details
MEDIUM 4.8
CVE-2018-1002000 December 3, 2018
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the del_ids variable by POST request. Full details
HIGH 7.2
CVE-2018-19796 December 3, 2018
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions download page) redirect parameter. Full details
MEDIUM 6.1
CVE-2018-19370 November 28, 2018
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import. Full details
MEDIUM 6.6
CVE-2018-19564 November 26, 2018
Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting. Full details
MEDIUM 6.1
CVE-2018-19287 November 15, 2018
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter. Full details
MEDIUM 6.1
CVE-2018-19207 November 12, 2018
The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018. Full details
CRITICAL 9.8
CVE-2018-18919 November 4, 2018
The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area. Full details
MEDIUM 4.8
CVE-2018-18461 October 18, 2018
The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code in attachments[] data to models/attachment.php. Full details
CRITICAL 9.8
CVE-2018-18460 October 18, 2018
XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request. Full details
MEDIUM 6.1
CVE-2018-18373 October 17, 2018
In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the… Full details
MEDIUM 5.4
CVE-2018-17866 October 9, 2018
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary… Full details
MEDIUM 6.1
CVE-2018-18069 October 8, 2018
process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php. Full details
MEDIUM 6.1
CVE-2015-9273 October 7, 2018
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking. Full details
MEDIUM 6.1
CVE-2015-9272 October 5, 2018
The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP… Full details
CRITICAL 9.8
CVE-2014-10076 October 5, 2018
The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archives via a brute-force attack. Full details
HIGH 7.5
CVE-2015-9271 October 4, 2018
The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing… Full details
CRITICAL 9.8
CVE-2018-17947 October 3, 2018
The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter. Full details
MEDIUM 6.1
CVE-2018-17946 October 3, 2018
The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter. Full details
MEDIUM 6.1
CVE-2018-17884 October 2, 2018
XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-admin/index.php Full details
MEDIUM 6.1
CVE-2015-9270 October 1, 2018
XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter. Full details
MEDIUM 6.1
CVE-2015-9269 October 1, 2018
The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensitive information because the content of a privately published post is sent in JSON format. Full details
HIGH 7.5
CVE-2018-17573 September 28, 2018
The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor under fckeditor/editor/filemanager/browser/default/browser.html, fckeditor/editor/filemanager/connectors/test.html, and fckeditor/editor/filemanager/connectors/uploadtest.html. Full details
CRITICAL 9.8
CVE-2018-16299 September 24, 2018
The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. Full details
HIGH 7.5
CVE-2018-16283 September 24, 2018
The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter. Full details
CRITICAL 9.8
CVE-2018-17140 September 17, 2018
The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php. Full details
MEDIUM 5.4
CVE-2018-17138 September 17, 2018
The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field. Full details
MEDIUM 5.4
CVE-2018-17074 September 16, 2018
The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter. Full details
MEDIUM 6.1
CVE-2018-16363 September 7, 2018
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php. Full details
MEDIUM 5.4
CVE-2018-16285 September 6, 2018
The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php. Full details
MEDIUM 6.1
CVE-2018-1000773 September 6, 2018
WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600. This attack appears to be exploitable… Full details
HIGH 8.8
CVE-2018-16308 September 1, 2018
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. Full details
HIGH 8.6
CVE-2018-16159 August 30, 2018
The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template request. Full details
CRITICAL 9.8
CVE-2018-15571 August 28, 2018
The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection. Full details
HIGH 8.6
CVE-2014-4932 August 28, 2018
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php. Full details
MEDIUM 6.1
CVE-2018-15877 August 26, 2018
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools request. Full details
HIGH 8.8
CVE-2018-15876 August 26, 2018
An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user… Full details
MEDIUM 5.3
CVE-2018-14028 August 10, 2018
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails,… Full details
HIGH 7.2
CVE-2018-14430 July 25, 2018
The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email action… Full details
MEDIUM 6.1
CVE-2018-13832 July 16, 2018
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text,… Full details
MEDIUM 4.8
CVE-2018-14071 July 16, 2018
The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input. Full details
CRITICAL 9.8
CVE-2016-6565 July 13, 2018
The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read… Full details
HIGH 7.5
CVE-2018-13136 July 4, 2018
The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen. Full details
MEDIUM 6.1
CVE-2018-12426 July 2, 2018
The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remote_upload request with a… Full details
CRITICAL 9.8
CVE-2018-12895 June 26, 2018
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This… Full details
HIGH 8.8
CVE-2018-1000556 June 26, 2018
WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from… Full details
MEDIUM 6.1