blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2026-12731 July 3, 2026
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes in all versions up to, and including,… Full details
MEDIUM 6.4
CVE-2026-12729 July 3, 2026
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.3.0. This is due to a missing capability… Full details
MEDIUM 4.3
CVE-2026-7311 July 2, 2026
The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_converted_image_size function in all versions up to, and… Full details
HIGH 8.1
CVE-2026-5524 July 2, 2026
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation… Full details
CRITICAL 9.8
CVE-2026-57685 July 2, 2026
Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme Full details
MEDIUM 4.3
CVE-2026-27402 July 2, 2026
Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress Full details
HIGH 7.1
CVE-2025-69156 July 2, 2026
Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme Full details
HIGH 7.1
CVE-2025-69154 July 2, 2026
Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme Full details
HIGH 7.1
CVE-2025-69152 July 2, 2026
Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress Full details
HIGH 7.1
CVE-2025-69134 July 2, 2026
Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper Full details
HIGH 7.5
CVE-2026-9834 July 2, 2026
The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the `wp_db_exclude_table`… Full details
HIGH 7.2
CVE-2026-9188 July 2, 2026
The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.7.6 via the `appointmentkey` parameter due to… Full details
MEDIUM 5.3
CVE-2026-9145 July 2, 2026
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versions up to, and including, 1.5.1. The function reads raw_value from… Full details
MEDIUM 6.5
CVE-2026-8441 July 2, 2026
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via… Full details
HIGH 7.5
CVE-2026-14029 July 2, 2026
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'select' parameter in all versions up to, and including, 4.5.8 due to insufficient escaping on… Full details
MEDIUM 6.5
CVE-2026-13459 July 2, 2026
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a… Full details
MEDIUM 5.3
CVE-2026-13369 July 2, 2026
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting… Full details
HIGH 7.5
CVE-2026-13252 July 2, 2026
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and… Full details
MEDIUM 6.4
CVE-2026-13251 July 2, 2026
The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it possible for unauthenticated attackers to read the contents of… Full details
HIGH 7.5
CVE-2026-12657 July 2, 2026
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.2 via the 'service_id' parameter due to… Full details
MEDIUM 5.3
CVE-2026-12472 July 2, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly… Full details
MEDIUM 5.3
CVE-2026-12134 July 2, 2026
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.7.8. This is due to the plugin… Full details
MEDIUM 4.3
CVE-2026-12122 July 2, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible… Full details
MEDIUM 5.3
CVE-2026-11896 July 2, 2026
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on… Full details
MEDIUM 5.3
CVE-2026-10104 July 2, 2026
The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom_thumbnail Parameter in all versions up to, and including, 1.5.1.8 due to insufficient input sanitization and output escaping.… Full details
MEDIUM 4.4
CVE-2026-5821 July 2, 2026
The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths… Full details
HIGH 8.1
CVE-2026-5348 July 2, 2026
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to the '/topics'… Full details
MEDIUM 5.3
CVE-2026-14249 July 2, 2026
The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP… Full details
HIGH 7.5
CVE-2026-13704 July 2, 2026
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]' parameter in all versions up to, and including, 4.16.1 due to insufficient input sanitization… Full details
MEDIUM 6.4
CVE-2026-13357 July 2, 2026
The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and… Full details
MEDIUM 4.9
CVE-2026-11965 July 2, 2026
The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating a paid membership subscription, allowing unauthenticated users (after self-registering an account through the open registration flow) to obtain… Full details
MEDIUM 6.5
CVE-2026-11781 July 2, 2026
The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administration search features, allowing users with a low-privilege role (Contributor) to disclose non-public content… Full details
LOW 2.7
CVE-2026-11600 July 2, 2026
The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs (and Off Canvas) widget's template… Full details
MEDIUM 4.3
CVE-2026-11592 July 2, 2026
The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due… Full details
MEDIUM 4.3
CVE-2026-11578 July 2, 2026
The Fluent Forms WordPress plugin before 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage, allowing a Manager limited to specific forms… Full details
LOW 2.7
CVE-2026-10089 July 2, 2026
The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys (meta key names) in all versions up to, and including, 3.11.4. This is due to insufficient output… Full details
MEDIUM 6.4
CVE-2026-10077 July 2, 2026
The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wp_kses_post(), as markup, allowing users with the Author role to perform Stored… Full details
MEDIUM 6.8
CVE-2026-13228 July 1, 2026
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct… Full details
HIGH 8.8
CVE-2026-12142 July 1, 2026
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]' Array Parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization… Full details
HIGH 7.2
CVE-2026-10095 July 1, 2026
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1.13.005 due to insufficient input sanitization and output escaping.… Full details
MEDIUM 6.4
CVE-2026-13454 July 1, 2026
The MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 2.4.5 due to insufficient escaping on the user supplied parameter… Full details
MEDIUM 6.5
CVE-2026-12754 July 1, 2026
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and… Full details
MEDIUM 6.1
CVE-2026-13733 July 1, 2026
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping. This makes… Full details
MEDIUM 6.4
CVE-2026-12732 July 1, 2026
The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to, and including, 4.4.0. This is due to insufficient input sanitization and output escaping in… Full details
MEDIUM 6.4
CVE-2026-12435 July 1, 2026
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying… Full details
MEDIUM 4.3
CVE-2026-12408 July 1, 2026
The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Content Disclosure in all versions up to, and including, 4.9.8 via the `/wp-json/slim-seo/meta-tags/ai` REST… Full details
MEDIUM 4.3
CVE-2026-12224 July 1, 2026
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the `update_capabilities()` REST handler accepting arbitrary capability… Full details
HIGH 8.8
CVE-2026-12158 July 1, 2026
The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on… Full details
HIGH 8.8
CVE-2026-11387 July 1, 2026
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5.… Full details
CRITICAL 9.8