blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,605
Affected records46,308
Newest source updateNovember 9, 2026
CVE-2026-11598 July 28, 2026
The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it… Full details
MEDIUM 5
CVE-2026-10207 July 28, 2026
The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in… Full details
HIGH 7.5
CVE-2026-15267 July 28, 2026
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter in versions up to, and including, 5.0.9. This is due… Full details
MEDIUM 6.5
CVE-2026-14516 July 28, 2026
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping… Full details
HIGH 7.5
CVE-2026-13161 July 28, 2026
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on… Full details
HIGH 7.5
CVE-2026-12800 July 28, 2026
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0.… Full details
HIGH 7.5
CVE-2026-15730 July 28, 2026
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in all versions up to, and including,… Full details
MEDIUM 6.4
CVE-2026-15673 July 28, 2026
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkout_payment_plans' and 'order_status' Settings in all versions up to,… Full details
MEDIUM 4.4
CVE-2026-15671 July 28, 2026
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in all versions up to, and… Full details
MEDIUM 4.9
CVE-2026-15670 July 28, 2026
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and… Full details
MEDIUM 4.9
CVE-2026-15014 July 28, 2026
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including,… Full details
CRITICAL 9.8
CVE-2026-12741 July 28, 2026
The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all versions up to, and including, 1.80.280 due to… Full details
HIGH 7.5
CVE-2026-6251 July 28, 2026
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_field() function in admin/class-admin-base.php retrieving the widget_id POST… Full details
MEDIUM 6.5
CVE-2026-16811 July 28, 2026
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient… Full details
MEDIUM 4.9
CVE-2026-16797 July 28, 2026
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to… Full details
MEDIUM 4.3
CVE-2026-16587 July 28, 2026
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly… Full details
MEDIUM 4.3
CVE-2026-16585 July 28, 2026
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in… Full details
HIGH 7.2
CVE-2026-15136 July 28, 2026
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or… Full details
MEDIUM 4.3
CVE-2026-15012 July 28, 2026
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This… Full details
MEDIUM 5.3
CVE-2026-14926 July 28, 2026
The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act… Full details
MEDIUM 4.2
CVE-2026-14924 July 28, 2026
The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary… Full details
HIGH 7.5
CVE-2026-14870 July 28, 2026
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site… Full details
HIGH 7.1
CVE-2026-14821 July 28, 2026
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates. Full details
LOW 2.7
CVE-2026-14819 July 28, 2026
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored… Full details
LOW 3.5
CVE-2026-14545 July 28, 2026
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account,… Full details
CRITICAL 9.8
CVE-2026-14490 July 28, 2026
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the… Full details
HIGH 7.5
CVE-2026-12124 July 28, 2026
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check… Full details
MEDIUM 5.3
CVE-2026-65561 July 27, 2026
Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register Full details
MEDIUM 6.5
CVE-2026-59549 July 27, 2026
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress Full details
CRITICAL 9.3
CVE-2026-9830 July 27, 2026
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking… Full details
HIGH 8.2
CVE-2026-14827 July 27, 2026
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary… Full details
MEDIUM 6.8
CVE-2026-14820 July 27, 2026
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing… Full details
MEDIUM 5.3
CVE-2026-14568 July 27, 2026
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently… Full details
MEDIUM 6.5
CVE-2026-14289 July 27, 2026
The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured… Full details
CRITICAL 9
CVE-2026-14236 July 27, 2026
The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an… Full details
MEDIUM 4.7
CVE-2026-14235 July 27, 2026
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an… Full details
HIGH 7.5
CVE-2026-14203 July 27, 2026
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to… Full details
MEDIUM 4.8
CVE-2026-14190 July 27, 2026
The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated… Full details
MEDIUM 6.1
CVE-2026-14189 July 27, 2026
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers… Full details
LOW 3.8
CVE-2026-13726 July 27, 2026
The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced… Full details
HIGH 7.1
CVE-2026-13714 July 27, 2026
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is… Full details
CRITICAL 9.8
CVE-2026-13597 July 27, 2026
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated… Full details
CRITICAL 9.1
CVE-2026-13400 July 27, 2026
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live… Full details
MEDIUM 6.1
CVE-2026-13390 July 27, 2026
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing… Full details
MEDIUM 5.3
CVE-2026-13332 July 27, 2026
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user… Full details
CRITICAL 9.1
CVE-2026-13152 July 27, 2026
The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table… Full details
HIGH 8.1
CVE-2026-12982 July 27, 2026
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability… Full details
MEDIUM 6.1