blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,580
Affected records46,283
Newest source updateNovember 8, 2026
CVE-2026-119747 November 4, 2026
The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invoicing permission. Authenticated… Full details
HIGH 7.1
CVE-2026-119745 November 4, 2026
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any… Full details
MEDIUM 5.3
CVE-2026-97397 November 4, 2026
The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions… Full details
HIGH 7.2
CVE-2026-104799 November 4, 2026
The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP… Full details
HIGH 8.8
CVE-2026-93900 November 4, 2026
The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the [gravity-simple-turnstile] shortcode in versions up to, and including, 1.44.3 This is due to… Full details
MEDIUM 6.4
CVE-2026-120554 November 4, 2026
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the… Full details
HIGH 8.8
CVE-2026-115498 November 4, 2026
The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g-website (Website contact-field)' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and output escaping.… Full details
HIGH 7.2
CVE-2026-118983 November 4, 2026
The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the… Full details
MEDIUM 6.8
CVE-2026-118783 November 4, 2026
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users… Full details
MEDIUM 6.8
CVE-2026-118637 November 4, 2026
The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose… Full details
LOW 2.7
CVE-2026-118523 November 4, 2026
The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review. Full details
MEDIUM 5.3
CVE-2026-118422 November 4, 2026
The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have… Full details
HIGH 7.1
CVE-2026-118407 November 4, 2026
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and… Full details
MEDIUM 5.4
CVE-2026-118404 November 4, 2026
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that… Full details
MEDIUM 5.3
CVE-2026-118403 November 4, 2026
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order… Full details
LOW 3.7
CVE-2026-115426 November 4, 2026
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those… Full details
MEDIUM 5.5
CVE-2026-115262 November 4, 2026
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their… Full details
MEDIUM 4.8
CVE-2026-115257 November 4, 2026
The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster. Full details
MEDIUM 5.3
CVE-2026-115250 November 4, 2026
The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side… Full details
MEDIUM 6.8
CVE-2026-115243 November 4, 2026
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate… Full details
MEDIUM 6.7
CVE-2026-115242 November 4, 2026
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler… Full details
MEDIUM 5.5
CVE-2026-115241 November 4, 2026
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so… Full details
MEDIUM 6.5
CVE-2026-114431 November 4, 2026
The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely… Full details
MEDIUM 6.4
CVE-2026-112244 November 4, 2026
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and… Full details
MEDIUM 5.3
CVE-2026-112243 November 4, 2026
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site… Full details
MEDIUM 5.8
CVE-2026-111962 November 4, 2026
The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other… Full details
LOW 3.7
CVE-2026-111740 November 4, 2026
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as… Full details
LOW 2.7
CVE-2026-110964 November 4, 2026
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library… Full details
MEDIUM 6.5
CVE-2026-110692 November 4, 2026
The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the… Full details
MEDIUM 4.1
CVE-2026-108068 November 4, 2026
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and… Full details
LOW 3.8
CVE-2026-108067 November 4, 2026
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify… Full details
LOW 3.8
CVE-2026-108041 November 4, 2026
The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress… Full details
HIGH 7.1
CVE-2026-106649 November 4, 2026
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later… Full details
MEDIUM 6.8
CVE-2026-106000 November 4, 2026
The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying. Full details
MEDIUM 5.3
CVE-2026-105413 November 4, 2026
The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as… Full details
HIGH 7.5
CVE-2026-105191 November 4, 2026
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record… Full details
MEDIUM 4.3
CVE-2026-104719 November 4, 2026
The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that… Full details
MEDIUM 6.4
CVE-2026-101166 November 4, 2026
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or… Full details
LOW 3.7
CVE-2026-101165 November 4, 2026
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's… Full details
LOW 3.7
CVE-2026-121509 November 3, 2026
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument… Full details
MEDIUM 5.5
CVE-2026-76124 November 3, 2026
The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies… Full details
HIGH 8.8
CVE-2026-91075 November 3, 2026
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark… Full details
MEDIUM 5.3
CVE-2026-103327 November 3, 2026
The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left… Full details
MEDIUM 5.3
CVE-2026-115205 November 3, 2026
The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts… Full details
MEDIUM 6.5
CVE-2026-106004 November 3, 2026
The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status. Full details
MEDIUM 5.3
CVE-2026-105993 November 3, 2026
The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's… Full details
MEDIUM 5.3
CVE-2026-105967 November 3, 2026
The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary… Full details
MEDIUM 5.8
CVE-2026-104648 November 3, 2026
The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which… Full details
MEDIUM 4.9
CVE-2026-104647 November 3, 2026
The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor… Full details
LOW 3.8
CVE-2026-103379 November 3, 2026
The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to… Full details
MEDIUM 5.3