blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,580
Affected records46,283
Newest source updateNovember 8, 2026
CVE-2015-4704 May 23, 2017
Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the File parameter to download.php. Full details
HIGH 7.5
CVE-2015-4455 May 23, 2017
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable… Full details
CRITICAL 9.8
CVE-2017-9066 May 18, 2017
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. Full details
HIGH 8.6
CVE-2017-9065 May 18, 2017
In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. Full details
HIGH 7.5
CVE-2017-9064 May 18, 2017
In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials. Full details
HIGH 8.8
CVE-2017-9063 May 18, 2017
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. Full details
MEDIUM 6.1
CVE-2017-9062 May 18, 2017
In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. Full details
HIGH 8.6
CVE-2017-9061 May 18, 2017
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename. Full details
MEDIUM 6.1
CVE-2015-4070 May 17, 2017
Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a… Full details
MEDIUM 6.1
CVE-2015-3998 May 17, 2017
Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php. Full details
MEDIUM 6.1
CVE-2017-8875 May 10, 2017
CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL. Full details
MEDIUM 6.5
CVE-2017-8295 May 4, 2017
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging… Full details
MEDIUM 5.9
CVE-2017-8100 April 24, 2017
There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings. Full details
MEDIUM 6.5
CVE-2017-8099 April 24, 2017
There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request. Full details
HIGH 8.1
CVE-2017-7723 April 24, 2017
XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body. Full details
MEDIUM 6.1
CVE-2017-7719 April 12, 2017
SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php. Full details
CRITICAL 9.8
CVE-2017-1001000 April 3, 2017
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed… Full details
HIGH 7.5
CVE-2017-6955 March 17, 2017
An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable,… Full details
MEDIUM 5.3
CVE-2017-6954 March 17, 2017
An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions. Full details
MEDIUM 4.3
CVE-2016-0770 March 16, 2017
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s variable. Full details
MEDIUM 6.1
CVE-2017-6819 March 12, 2017
In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that… Full details
MEDIUM 6.5
CVE-2017-6818 March 12, 2017
In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names. Full details
MEDIUM 6.1
CVE-2017-6817 March 12, 2017
In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds. Full details
MEDIUM 5.4
CVE-2017-6816 March 12, 2017
In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality. Full details
MEDIUM 4.9
CVE-2017-6815 March 12, 2017
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. Full details
MEDIUM 6.1
CVE-2017-6814 March 12, 2017
In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling… Full details
MEDIUM 5.4
CVE-2017-6578 March 9, 2017
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: subscriber_email. Full details
HIGH 7.2
CVE-2017-6577 March 9, 2017
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: list_id. Full details
HIGH 7.2
CVE-2017-6576 March 9, 2017
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/campaign-delete.php with the GET Parameter: id. Full details
HIGH 7.2
CVE-2017-6575 March 9, 2017
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit_member.php with the GET Parameter: member_id. Full details
HIGH 7.2
CVE-2017-6574 March 9, 2017
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit_member.php with the GET Parameter: filter_list. Full details
HIGH 7.2
CVE-2017-6573 March 9, 2017
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit-list.php with the GET Parameter: id. Full details
HIGH 7.2
CVE-2017-6572 March 9, 2017
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/add_member.php with the GET Parameter: filter_list. Full details
HIGH 7.2
CVE-2017-6571 March 9, 2017
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign.php with the GET Parameter: id. Full details
HIGH 7.2
CVE-2017-6570 March 9, 2017
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign-list.php with the GET Parameter: id. Full details
HIGH 7.2
CVE-2017-6104 March 2, 2017
Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0. Full details
HIGH 7.5
CVE-2017-6098 February 21, 2017
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign_save.php (Requires authentication to Wordpress admin) with the POST Parameter: list_id. Full details
HIGH 7.2
CVE-2017-6097 February 21, 2017
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.php (Requires authentication to Wordpress admin) with the POST Parameter: camp_id. Full details
HIGH 7.2
CVE-2017-6096 February 21, 2017
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/view-list.php (Requires authentication to Wordpress admin) with the GET Parameter: filter_list. Full details
HIGH 7.2
CVE-2017-6095 February 21, 2017
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php (Unauthenticated) with the GET Parameter: list_id. Full details
CRITICAL 9.8
CVE-2017-5942 February 10, 2017
An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected XSS. This would allow you to execute JavaScript in the… Full details
MEDIUM 6.1
CVE-2017-5612 January 30, 2017
Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt. Full details
MEDIUM 6.1
CVE-2017-5611 January 30, 2017
SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post… Full details
CRITICAL 9.8
CVE-2017-5610 January 30, 2017
wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms. Full details
MEDIUM 5.3
CVE-2016-0769 January 23, 2017
Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL… Full details
HIGH 8.8
CVE-2016-0765 January 23, 2017
Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) action parameter. Full details
MEDIUM 6.1
CVE-2016-6897 January 18, 2017
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to… Full details
MEDIUM 6.5
CVE-2016-6896 January 18, 2017
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the… Full details
HIGH 7.1