High
CVE-2017-18602
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.
Tag: WordPress
All CVEs associated with "WordPress". Page 135/152 • 18152 CVEs.
Subscribe CVEs: RSS for “WordPress” · RSS (High+Critical only)
About “WordPress”
A curated feed of “WordPress”-related CVEs appears below. We currently track 18152 CVEs for this tag (all time). In the last 365 days, 4094 were published. Average CVSS is 6.3 (all time; 6.3 over 365d), and 27% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-862 - Missing Authorization, CWE-352 - Cross-Site Request Forgery (CSRF).
In our taxonomy this topic maps to a MODERATE impact class. CMS and plugins expand attack surface. Patch core, themes, and plugins, remove abandoned extensions, restrict admin access, enable WAF, and keep backups. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.
CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).
CVSS ≥ 0.0
2019-09-10
Medium
CVE-2017-18601
The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
Medium
CVE-2017-18600
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
Medium
CVE-2017-18599
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.
Medium
CVE-2017-18598
The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.
High
CVE-2017-18597
The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter.
High
CVE-2017-18596
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.
2019-09-09
High
CVE-2019-15895
search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.
Medium
CVE-2018-21014
The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.
Critical
CVE-2018-21013
The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php.
Medium
CVE-2018-21012
The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.
High
CVE-2018-21011
The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.
2019-09-08
High
CVE-2019-16120
CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.
Critical
CVE-2019-16119
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.
Medium
CVE-2019-16118
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.
Medium
CVE-2019-16117
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.
2019-09-04
Medium
CVE-2019-14470
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.
2019-09-03
Medium
CVE-2019-15889
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
High
CVE-2019-15873
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php…
Critical
CVE-2019-15872
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
Medium
CVE-2019-15871
The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.
Medium
CVE-2019-15870
The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.
Medium
CVE-2019-15869
The JobCareer theme before 2.5.1 for WordPress has stored XSS.
High
CVE-2019-15868
The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.
High
CVE-2019-15867
The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX action.
High
CVE-2019-15866
The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.
High
CVE-2019-15865
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.
Medium
CVE-2019-15864
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.
High
CVE-2019-15863
The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.
High
CVE-2019-15858
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code e…
2019-08-30
Medium
CVE-2019-15842
The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.
High
CVE-2019-15841
The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility.
High
CVE-2019-15840
The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.
High
CVE-2019-15839
The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.
Medium
CVE-2019-15838
The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.
Medium
CVE-2019-15837
The webp-express plugin before 0.14.8 for WordPress has stored XSS.
Medium
CVE-2019-15836
The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.
High
CVE-2019-15835
The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.
High
CVE-2019-15834
The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.
Medium
CVE-2019-15833
The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.
High
CVE-2019-15832
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.
High
CVE-2019-15831
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
Medium
CVE-2019-15830
The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.
Medium
CVE-2019-15829
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.
High
CVE-2019-15828
The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.
Medium
CVE-2019-15827
The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.
Critical
CVE-2019-15826
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
Critical
CVE-2019-15825
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
Critical
CVE-2019-15824
The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
Critical
CVE-2019-15823
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
Critical
CVE-2019-15822
The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.
High
CVE-2019-15821
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
Medium
CVE-2019-15820
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
Critical
CVE-2019-15819
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
Medium
CVE-2019-15818
The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
Medium
CVE-2019-15817
The easy-property-listings plugin before 3.4 for WordPress has XSS.
High
CVE-2019-15816
The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
High
CVE-2015-9380
The photo-gallery plugin before 1.2.42 for WordPress has CSRF.
2019-08-29
Medium
CVE-2019-14979
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purcha…
Medium
CVE-2019-14978
/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for l…
High
CVE-2019-15781
The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.
High
CVE-2019-15779
The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.
Medium
CVE-2019-15778
The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.
Medium
CVE-2019-15771
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Critical
CVE-2019-15780
The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.
Medium
CVE-2019-15777
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.
Medium
CVE-2019-15776
The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.
Medium
CVE-2019-15775
The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Medium
CVE-2019-15774
The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Medium
CVE-2019-15773
The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Medium
CVE-2019-15772
The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
High
CVE-2019-15770
The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.
High
CVE-2019-15769
The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.
Critical
CVE-2018-21007
The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.
2019-08-28
Medium
CVE-2015-9359
The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9379
iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9378
iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9377
iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9376
iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9375
Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9374
Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9373
PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9372
Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9371
Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9370
Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9369
Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2019-15713
The my-calendar plugin before 3.1.10 for WordPress has XSS.
Medium
CVE-2017-18593
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
Medium
CVE-2015-9368
Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9367
Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9366
Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9365
Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9364
2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9363
iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9362
The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9361
The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9360
The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9358
The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
Medium
CVE-2015-9357
The akismet plugin before 3.1.5 for WordPress has XSS.
Medium
CVE-2015-9356
The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.
Medium
CVE-2015-9355
The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Medium
CVE-2015-9354
The gigpress plugin before 2.3.11 for WordPress has XSS.
High
CVE-2015-9353
The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
Critical
CVE-2012-6719
The sharebar plugin before 1.2.2 for WordPress has SQL injection.
Medium
CVE-2012-6718
The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.
Medium
CVE-2012-6717
The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.
Medium
CVE-2011-5329
The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.
2019-08-27
Critical
CVE-2019-14314
A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrar…
High
CVE-2019-15660
The wp-members plugin before 3.2.8 for WordPress has CSRF.
Medium
CVE-2019-15650
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme updates) because of a nonce check error.
High
CVE-2017-18592
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.
Medium
CVE-2017-18591
The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.
Medium
CVE-2016-10936
The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.
Critical
CVE-2015-9352
The wp-polls plugin before 2.72 for WordPress has SQL injection.
Critical
CVE-2015-9351
The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.
Medium
CVE-2015-9350
The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
High
CVE-2015-9348
The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.
Critical
CVE-2019-15659
The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
High
CVE-2019-15649
The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.
Medium
CVE-2019-15648
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.