blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2017-1002022 September 14, 2017
Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query. Full details
CRITICAL 9.8
CVE-2017-1002021 September 14, 2017
Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an SQL query. Full details
CRITICAL 9.8
CVE-2017-1002020 September 14, 2017
Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query. Full details
CRITICAL 9.8
CVE-2017-1002019 September 14, 2017
Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the event parameter. Full details
CRITICAL 9.8
CVE-2017-1002018 September 14, 2017
Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter. Full details
CRITICAL 9.8
CVE-2017-1002017 September 14, 2017
Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability. Full details
MEDIUM 6.1
CVE-2017-1002016 September 14, 2017
Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files. Full details
CRITICAL 9.8
CVE-2017-1002015 September 14, 2017
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallery parameter. Full details
CRITICAL 9.8
CVE-2017-1002014 September 14, 2017
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name parameter. Full details
CRITICAL 9.8
CVE-2017-1002013 September 14, 2017
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.php. Full details
CRITICAL 9.8
CVE-2017-1002012 September 14, 2017
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement. Full details
CRITICAL 9.8
CVE-2017-1002011 September 14, 2017
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_description where anyone with privileges to modify or add galleries/images and inject javascript into the database. Full details
MEDIUM 5.4
CVE-2017-1002010 September 14, 2017
Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete_media function. Full details
CRITICAL 9.8
CVE-2017-1002009 September 14, 2017
Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function. Full details
CRITICAL 9.8
CVE-2017-1002008 September 14, 2017
Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges. Full details
CRITICAL 9.8
CVE-2017-1002007 September 14, 2017
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table. Full details
HIGH 7.5
CVE-2017-1002006 September 14, 2017
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table. Full details
HIGH 7.5
CVE-2017-1002005 September 14, 2017
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the end of an SQL query. Full details
HIGH 7.5
CVE-2017-1002004 September 14, 2017
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query. Full details
HIGH 7.5
CVE-2017-1002003 September 14, 2017
Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com. Full details
CRITICAL 9.8
CVE-2017-1002002 September 14, 2017
Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/ Full details
CRITICAL 9.8
CVE-2017-1002001 September 14, 2017
Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com. Full details
CRITICAL 9.8
CVE-2017-1002000 September 14, 2017
Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php doesn't require authentication or check that the user is allowed to upload content. Full details
CRITICAL 9.8
CVE-2015-9230 September 12, 2017
In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators via the DBTablePrefix parameter. Full details
MEDIUM 4.8
CVE-2015-9229 September 12, 2017
In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images[1][alttext] parameter. Full details
MEDIUM 4.8
CVE-2015-9228 September 12, 2017
In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php. Full details
HIGH 8.8
CVE-2017-14313 September 12, 2017
The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg(). Full details
MEDIUM 6.1
CVE-2015-8354 September 11, 2017
Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to wp-admin/users.php. Full details
MEDIUM 6.1
CVE-2015-8353 September 11, 2017
Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the object_name parameter in a rs-object_role_edit page to wp-admin/admin.php. Full details
MEDIUM 6.1
CVE-2015-8351 September 11, 2017
PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter… Full details
CRITICAL 9
CVE-2015-8350 September 11, 2017
Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action… Full details
MEDIUM 6.1
CVE-2015-4697 September 7, 2017
Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563. Full details
HIGH 8.8
CVE-2015-3314 September 7, 2017
SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5. Full details
HIGH 8.1
CVE-2015-3313 September 7, 2017
SQL injection vulnerability in WordPress Community Events plugin before 1.4. Full details
CRITICAL 9.8
CVE-2017-9834 September 7, 2017
SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action to wp-admin/admin-ajax.php. Full details
CRITICAL 9.8
CVE-2017-14126 September 4, 2017
The Participants Database plugin before 1.7.5.10 for WordPress has XSS. Full details
MEDIUM 6.1
CVE-2015-7517 August 29, 2017
Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commands via the ver parameter to (1) class-doifd-download.php or (2) class-doifd-landing-page.php in… Full details
CRITICAL 9.8
CVE-2017-13138 August 23, 2017
DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript. Full details
MEDIUM 6.1
CVE-2017-13137 August 23, 2017
The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php. Full details
CRITICAL 9.8
CVE-2017-12977 August 21, 2017
The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. It is exploitable by administrators… Full details
HIGH 7.2
CVE-2017-12949 August 18, 2017
lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF. Full details
HIGH 8.8
CVE-2017-12948 August 18, 2017
Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF. Full details
MEDIUM 6.1
CVE-2017-12947 August 18, 2017
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators. Full details
HIGH 7.2
CVE-2017-12946 August 18, 2017
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators. Full details
HIGH 7.2
CVE-2015-5057 August 18, 2017
Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed. Full details
MEDIUM 6.1
CVE-2017-12651 August 7, 2017
Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HTTP Referer header is not checked. Full details
HIGH 8.8
CVE-2017-12650 August 7, 2017
SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header. Full details
CRITICAL 9.8
CVE-2014-9262 August 7, 2017
The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files. Full details
HIGH 8.2
CVE-2014-9260 August 7, 2017
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option. Full details
HIGH 8.8
CVE-2017-12200 August 2, 2017
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component. Full details
MEDIUM 6.1