blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2014-5072 April 6, 2018
Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Full details
HIGH 8.8
CVE-2014-5034 April 6, 2018
Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that have unknown impact via a crafted… Full details
HIGH 8.8
CVE-2018-9035 April 4, 2018
CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject spreadsheet formulas into CSV files via the contact form. Full details
CRITICAL 9.6
CVE-2018-9034 April 4, 2018
Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the tab GET parameter. Full details
MEDIUM 5.4
CVE-2018-8719 April 4, 2018
An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. For example, these files are indexed by Google and allows for attackers to… Full details
MEDIUM 5.3
CVE-2018-9172 April 1, 2018
The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes. Full details
MEDIUM 5.4
CVE-2014-6604 March 29, 2018
Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ip parameter. Full details
MEDIUM 6.1
CVE-2018-7543 March 26, 2018
Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter. Full details
MEDIUM 6.1
CVE-2018-9020 March 26, 2018
The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature. Full details
MEDIUM 5.4
CVE-2014-2675 March 19, 2018
Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete the sitemap via a request… Full details
MEDIUM 6.5
CVE-2014-2674 March 19, 2018
Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the loop parameter in an ajax_navigation action to… Full details
HIGH 7.5
CVE-2014-2550 March 19, 2018
Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disable_comments_settings… Full details
HIGH 8.8
CVE-2014-2297 March 19, 2018
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2)… Full details
MEDIUM 6.1
CVE-2014-2274 March 19, 2018
Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via… Full details
HIGH 8.8
CVE-2018-7422 March 19, 2018
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal. Full details
HIGH 7.5
CVE-2018-8729 March 15, 2018
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped. Full details
MEDIUM 6.1
CVE-2018-8711 March 14, 2018
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to… Full details
CRITICAL 9.8
CVE-2018-8710 March 14, 2018
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page… Full details
CRITICAL 9.8
CVE-2018-1000131 March 14, 2018
Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets, the parameter email in cookie was injected that can result in… Full details
CRITICAL 9.8
CVE-2018-0547 March 9, 2018
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors. Full details
MEDIUM 6.1
CVE-2018-0546 March 9, 2018
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors. Full details
MEDIUM 6.1
CVE-2018-7204 March 7, 2018
inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php contents get added… Full details
HIGH 7.5
CVE-2018-7433 March 2, 2018
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page. Full details
HIGH 7.5
CVE-2018-7586 March 1, 2018
In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured. Full details
HIGH 7.5
CVE-2015-2324 February 19, 2018
Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit permission to inject arbitrary web script or HTML via unspecified vectors. Full details
MEDIUM 5.4
CVE-2018-6944 February 16, 2018
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable. Full details
MEDIUM 6.1
CVE-2018-6943 February 16, 2018
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable. Full details
MEDIUM 6.1
CVE-2018-6891 February 11, 2018
Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js. Full details
MEDIUM 6.1
CVE-2015-2329 February 8, 2018
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order. Full details
MEDIUM 6.1
CVE-2018-6389 February 6, 2018
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every… Full details
HIGH 7.5
CVE-2018-6469 February 6, 2018
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_tags parameter to wp-admin/options-general.php. Full details
MEDIUM 6.1
CVE-2018-6468 February 6, 2018
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_id parameter to wp-admin/options-general.php. Full details
MEDIUM 6.1
CVE-2018-6467 February 6, 2018
The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php. Full details
HIGH 8.8
CVE-2018-6466 February 6, 2018
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_set parameter to wp-admin/options-general.php. Full details
MEDIUM 6.1
CVE-2015-4179 February 5, 2018
Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress. Full details
HIGH 8.8
CVE-2018-6465 January 31, 2018
The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php. Full details
MEDIUM 6.1
CVE-2018-6195 January 30, 2018
admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET… Full details
HIGH 7.2
CVE-2018-6194 January 30, 2018
A cross-site scripting (XSS) vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php. Full details
MEDIUM 4.8
CVE-2018-6357 January 27, 2018
The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS. Full details
HIGH 8.8
CVE-2018-6015 January 26, 2018
An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body,… Full details
HIGH 7.5
CVE-2018-6002 January 22, 2018
The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview parameter). Full details
MEDIUM 6.1
CVE-2018-6001 January 22, 2018
The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview parameter). Full details
MEDIUM 6.1
CVE-2018-5776 January 18, 2018
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement). Full details
MEDIUM 6.1
CVE-2017-18032 January 16, 2018
The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php. Full details
MEDIUM 6.1
CVE-2018-5695 January 14, 2018
The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-admin/admin.php. Full details
HIGH 7.2
CVE-2018-5673 January 13, 2018
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php. Full details
HIGH 8.8
CVE-2018-5672 January 13, 2018
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter. Full details
MEDIUM 4.8
CVE-2018-5671 January 13, 2018
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter. Full details
MEDIUM 4.8
CVE-2018-5670 January 13, 2018
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter. Full details
MEDIUM 4.8