blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2018-12636 June 22, 2018
The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page. Full details
HIGH 7.2
CVE-2018-11526 June 19, 2018
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection. Full details
HIGH 7.8
CVE-2018-11525 June 19, 2018
The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection. Full details
HIGH 7.8
CVE-2018-12534 June 18, 2018
A SQL injection issue was discovered in the Quick Chat plugin before 4.00 for WordPress. Full details
CRITICAL 9.8
CVE-2018-10969 June 17, 2018
SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid. Full details
CRITICAL 9.8
CVE-2018-10363 June 13, 2018
An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices. Full details
HIGH 7.5
CVE-2018-11709 June 4, 2018
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI. Full details
MEDIUM 6.1
CVE-2018-11486 June 1, 2018
An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-site scripting (XSS) vulnerability. A non-authenticated user can save the… Full details
MEDIUM 6.1
CVE-2018-11485 June 1, 2018
The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce -> Orders admin page. The attack… Full details
MEDIUM 6.1
CVE-2018-11633 May 31, 2018
An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear… Full details
MEDIUM 6.5
CVE-2018-11632 May 31, 2018
An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an… Full details
MEDIUM 6.5
CVE-2018-11580 May 31, 2018
An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user… Full details
MEDIUM 5.4
CVE-2018-11579 May 31, 2018
class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request… Full details
MEDIUM 5.3
CVE-2018-11568 May 30, 2018
Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some (but not all) cases, the '' characters have <… Full details
MEDIUM 6.1
CVE-2018-11309 May 28, 2018
Blind SQL injection in coupon_code in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the WordPress MySQL database via an applyCoupon action in an admin-ajax.php request. Full details
CRITICAL 9.8
CVE-2018-11515 May 28, 2018
The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter. Full details
CRITICAL 9.8
CVE-2018-11366 May 22, 2018
init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is mishandled. This is fixed in 1.4.0. Full details
MEDIUM 6.1
CVE-2018-11244 May 18, 2018
The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor. Full details
MEDIUM 5.3
CVE-2018-11105 May 15, 2018
There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a… Full details
MEDIUM 6.1
CVE-2018-0590 May 14, 2018
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors. Full details
MEDIUM 4.3
CVE-2018-0589 May 14, 2018
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms' page via unspecified vectors. Full details
MEDIUM 4.3
CVE-2018-0588 May 14, 2018
Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors. Full details
HIGH 7.5
CVE-2018-0587 May 14, 2018
Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors. Full details
MEDIUM 4.3
CVE-2018-0586 May 14, 2018
Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors. Full details
MEDIUM 4.3
CVE-2018-0585 May 14, 2018
Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Full details
MEDIUM 5.4
CVE-2018-0579 May 14, 2018
Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Full details
MEDIUM 6.1
CVE-2018-0578 May 14, 2018
Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Full details
MEDIUM 5.4
CVE-2018-0577 May 14, 2018
Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Full details
MEDIUM 5.4
CVE-2018-0576 May 14, 2018
Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Full details
MEDIUM 5.4
CVE-2018-10752 May 5, 2018
The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action. Full details
MEDIUM 4.8
CVE-2018-10371 May 1, 2018
An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of… Full details
MEDIUM 6.1
CVE-2018-10504 April 27, 2018
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection. Full details
HIGH 7.8
CVE-2014-5014 April 25, 2018
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path. Full details
CRITICAL 9.8
CVE-2018-10310 April 25, 2018
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress that allows the execution of arbitrary HTML/script code in the context… Full details
MEDIUM 5.4
CVE-2018-10309 April 24, 2018
The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS. Full details
MEDIUM 5.4
CVE-2018-10301 April 23, 2018
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an… Full details
MEDIUM 6.1
CVE-2018-10300 April 23, 2018
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio. Full details
MEDIUM 6.1
CVE-2018-10234 April 23, 2018
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options&section=account page. Full details
MEDIUM 4.8
CVE-2018-10233 April 23, 2018
The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin. Full details
HIGH 8.8
CVE-2018-7747 April 20, 2018
Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a greeting message, (2) the email… Full details
MEDIUM 4.8
CVE-2018-10102 April 16, 2018
Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag. Full details
MEDIUM 6.1
CVE-2018-10101 April 16, 2018
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server. Full details
MEDIUM 6.1
CVE-2018-10100 April 16, 2018
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. Full details
MEDIUM 6.1
CVE-2014-6412 April 12, 2018
WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach. Full details
HIGH 8.1
CVE-2018-9118 April 12, 2018
exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter. Full details
HIGH 7.5
CVE-2015-4557 April 12, 2018
Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter.… Full details
MEDIUM 6.1
CVE-2014-3114 April 10, 2018
The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd parameter to functions/ezpz-archive-cmd.php. Full details
CRITICAL 9.8
CVE-2014-1889 April 10, 2018
The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check. Full details
MEDIUM 6.5
CVE-2018-9864 April 9, 2018
The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field. Full details
MEDIUM 6.1
CVE-2018-9844 April 7, 2018
The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. Full details
MEDIUM 6.1