blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2018-5669 January 13, 2018
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php. Full details
HIGH 8.8
CVE-2018-5668 January 13, 2018
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_title parameter. Full details
MEDIUM 4.8
CVE-2018-5667 January 13, 2018
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_pattern parameter. Full details
MEDIUM 4.8
CVE-2018-5666 January 13, 2018
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bg_color parameter. Full details
MEDIUM 4.8
CVE-2018-5665 January 13, 2018
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_height parameter. Full details
MEDIUM 4.8
CVE-2018-5664 January 13, 2018
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php social_icon_1 parameter. Full details
MEDIUM 4.8
CVE-2018-5663 January 13, 2018
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php button_text_link parameter. Full details
MEDIUM 4.8
CVE-2018-5662 January 13, 2018
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title parameter. Full details
MEDIUM 4.8
CVE-2018-5661 January 13, 2018
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_width parameter. Full details
MEDIUM 4.8
CVE-2018-5660 January 13, 2018
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_sub_title parameter. Full details
MEDIUM 4.8
CVE-2018-5659 January 13, 2018
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_title parameter. Full details
MEDIUM 4.8
CVE-2018-5658 January 13, 2018
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php. Full details
HIGH 8.8
CVE-2018-5657 January 13, 2018
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title_icon parameter. Full details
MEDIUM 4.8
CVE-2018-5656 January 13, 2018
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php. Full details
HIGH 8.8
CVE-2018-5655 January 13, 2018
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security parameter. Full details
MEDIUM 6.1
CVE-2018-5654 January 13, 2018
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREE_Access_Token parameter. Full details
MEDIUM 6.1
CVE-2018-5653 January 13, 2018
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizar_pffree_settings_save_get-users parameter. Full details
MEDIUM 6.1
CVE-2018-5652 January 13, 2018
An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_end parameter. Full details
MEDIUM 4.8
CVE-2018-5651 January 13, 2018
An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_start parameter. Full details
MEDIUM 4.8
CVE-2016-10706 January 12, 2018
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. Full details
MEDIUM 6.1
CVE-2016-10705 January 12, 2018
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. Full details
MEDIUM 6.1
CVE-2018-5315 January 12, 2018
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php. Full details
CRITICAL 9.8
CVE-2018-5374 January 12, 2018
The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter). Full details
HIGH 8.8
CVE-2018-5373 January 12, 2018
The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter). Full details
HIGH 8.8
CVE-2018-5372 January 12, 2018
The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter). Full details
HIGH 8.8
CVE-2018-5369 January 12, 2018
The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter. Full details
MEDIUM 4.8
CVE-2018-5368 January 12, 2018
The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php. Full details
HIGH 8.8
CVE-2018-5367 January 12, 2018
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php. Full details
MEDIUM 4.8
CVE-2018-5366 January 12, 2018
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php. Full details
MEDIUM 4.8
CVE-2018-5365 January 12, 2018
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php. Full details
MEDIUM 4.8
CVE-2018-5364 January 12, 2018
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php. Full details
MEDIUM 4.8
CVE-2018-5363 January 12, 2018
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php. Full details
MEDIUM 4.8
CVE-2018-5362 January 12, 2018
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php. Full details
MEDIUM 4.8
CVE-2018-5361 January 12, 2018
The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php. Full details
HIGH 8.8
CVE-2018-5316 January 9, 2018
The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter. Full details
MEDIUM 6.1
CVE-2018-5312 January 9, 2018
The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php. Full details
MEDIUM 5.4
CVE-2018-5311 January 9, 2018
The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php?page=tonjoo_excerpt URI. Full details
MEDIUM 5.4
CVE-2018-5310 January 9, 2018
In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-search-register URI. Full details
MEDIUM 6.5
CVE-2014-4972 January 8, 2018
Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via… Full details
CRITICAL 9.8
CVE-2018-5293 January 8, 2018
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page. Full details
MEDIUM 6.1
CVE-2018-5292 January 8, 2018
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page. Full details
MEDIUM 6.1
CVE-2018-5291 January 8, 2018
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page. Full details
HIGH 7.5
CVE-2018-5290 January 8, 2018
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page. Full details
HIGH 7.5
CVE-2018-5289 January 8, 2018
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page. Full details
HIGH 7.5
CVE-2018-5288 January 8, 2018
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page. Full details
MEDIUM 6.1
CVE-2018-5287 January 8, 2018
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page. Full details
HIGH 7.5
CVE-2018-5286 January 8, 2018
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page. Full details
MEDIUM 6.1
CVE-2018-5285 January 8, 2018
The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php. Full details
HIGH 8.8
CVE-2018-5284 January 8, 2018
The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php. Full details
MEDIUM 4.8
CVE-2014-8336 January 5, 2018
The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of… Full details
MEDIUM 6.5