blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,616
Affected records46,319
Newest source updateNovember 10, 2026
CVE-2026-8089 June 17, 2026
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected… Full details
HIGH 7.1
CVE-2026-7850 June 17, 2026
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or… Full details
MEDIUM 5.9
CVE-2026-25470 June 17, 2026
Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for WordPress Full details
CRITICAL 10
CVE-2026-12360 June 17, 2026
The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query… Full details
HIGH 7.5
CVE-2026-12165 June 17, 2026
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 30.0.2 via the `RegistryUserRole` parameter.… Full details
HIGH 8.8
CVE-2026-12115 June 17, 2026
The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input… Full details
MEDIUM 6.6
CVE-2025-69135 June 17, 2026
Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin Full details
HIGH 8.5
CVE-2025-69131 June 17, 2026
Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site Full details
HIGH 7.5
CVE-2025-69129 June 17, 2026
Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site Full details
CRITICAL 10
CVE-2025-49403 June 17, 2026
Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress Full details
HIGH 7.5
CVE-2026-8442 June 16, 2026
The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX… Full details
HIGH 8.1
CVE-2026-8176 June 16, 2026
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that… Full details
HIGH 7.5
CVE-2026-2381 June 16, 2026
The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to, and including, 10.7.0 This… Full details
MEDIUM 6.5
CVE-2026-8444 June 16, 2026
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the… Full details
HIGH 8.8
CVE-2026-10093 June 16, 2026
The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all versions up to, and including, 2.1.6 due to insufficient… Full details
MEDIUM 6.4
CVE-2026-9187 June 16, 2026
The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation… Full details
MEDIUM 5.3
CVE-2026-8443 June 16, 2026
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due… Full details
HIGH 8.8
CVE-2026-6933 June 16, 2026
The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check… Full details
HIGH 8.8
CVE-2026-5149 June 16, 2026
The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_submission_content AJAX endpoint lacking a capability check to verify that a… Full details
MEDIUM 6.5
CVE-2026-10780 June 16, 2026
The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2. This is due to the static_block_content() shortcode handler retrieving a post via get_post()… Full details
MEDIUM 4.3
CVE-2026-6964 June 16, 2026
The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is… Full details
MEDIUM 5.3
CVE-2026-49776 June 15, 2026
Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites Full details
CRITICAL 9.3
CVE-2026-48964 June 15, 2026
Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System Full details
HIGH 8.5
CVE-2026-40773 June 15, 2026
Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress Full details
MEDIUM 6.5
CVE-2026-39468 June 15, 2026
Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework Full details
MEDIUM 6.8
CVE-2019-25746 June 15, 2026
WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint… Full details
HIGH 7.1
CVE-2018-25437 June 15, 2026
WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory… Full details
HIGH 8.7
CVE-2018-25436 June 15, 2026
WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with malicious file… Full details
CRITICAL 9.3
CVE-2016-20084 June 15, 2026
WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the… Full details
MEDIUM 5.1
CVE-2016-20083 June 15, 2026
WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into… Full details
MEDIUM 6.9
CVE-2016-20082 June 15, 2026
WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the action parameter. Attackers can send GET requests to abtest_admin.php with malicious action values to… Full details
MEDIUM 6.9
CVE-2016-20081 June 15, 2026
WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with… Full details
HIGH 8.7
CVE-2016-20080 June 15, 2026
WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to include arbitrary files by manipulating the wp_abspath parameter. Attackers can supply path traversal sequences… Full details
MEDIUM 6.9
CVE-2016-20079 June 15, 2026
WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter. Attackers can supply file paths with directory traversal sequences… Full details
MEDIUM 6.9
CVE-2016-20078 June 15, 2026
WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the url parameter. Attackers can supply directory traversal sequences in GET requests to… Full details
MEDIUM 6.9
CVE-2016-20077 June 15, 2026
WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the… Full details
MEDIUM 6.9
CVE-2016-20076 June 15, 2026
WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using… Full details
HIGH 8.7
CVE-2016-20075 June 15, 2026
WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can… Full details
HIGH 8.7
CVE-2016-20074 June 15, 2026
WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to… Full details
MEDIUM 5.3
CVE-2016-20073 June 15, 2026
Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Attackers can submit crafted… Full details
HIGH 8.8
CVE-2016-20072 June 15, 2026
BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages… Full details
HIGH 8.8
CVE-2016-20071 June 15, 2026
The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. Attackers can… Full details
HIGH 8.8
CVE-2016-20070 June 15, 2026
WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize… Full details
MEDIUM 5.1
CVE-2016-20069 June 15, 2026
WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL… Full details
HIGH 8.8
CVE-2016-20068 June 15, 2026
WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send… Full details
HIGH 8.8
CVE-2016-20067 June 15, 2026
WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML pages that execute unwanted poll operations when… Full details
MEDIUM 5.3