Critical
CVE-2016-10888
The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
Tag: WordPress
All CVEs associated with "WordPress". Page 138/152 • 18152 CVEs.
Subscribe CVEs: RSS for “WordPress” · RSS (High+Critical only)
About “WordPress”
A curated feed of “WordPress”-related CVEs appears below. We currently track 18152 CVEs for this tag (all time). In the last 365 days, 4094 were published. Average CVSS is 6.3 (all time; 6.3 over 365d), and 27% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-862 - Missing Authorization, CWE-352 - Cross-Site Request Forgery (CSRF).
In our taxonomy this topic maps to a MODERATE impact class. CMS and plugins expand attack surface. Patch core, themes, and plugins, remove abandoned extensions, restrict admin access, enable WAF, and keep backups. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.
CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).
CVSS ≥ 0.0
2019-08-14
Critical
CVE-2016-10887
The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
Critical
CVE-2016-10886
The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
High
CVE-2016-10885
The wp-editor plugin before 1.2.6 for WordPress has CSRF.
High
CVE-2016-10884
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
Medium
CVE-2016-10883
The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
High
CVE-2016-10882
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
Medium
CVE-2016-10881
The google-document-embedder plugin before 2.6.2 for WordPress has XSS.
Medium
CVE-2016-10880
The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
Critical
CVE-2015-9310
The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
High
CVE-2015-9309
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
High
CVE-2015-9308
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
High
CVE-2015-9307
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
High
CVE-2013-7476
The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
Critical
CVE-2019-15025
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
Critical
CVE-2017-18514
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Critical
CVE-2016-10889
The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
Critical
CVE-2015-9316
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
Critical
CVE-2015-9315
The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
Medium
CVE-2015-9314
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
Critical
CVE-2015-9313
The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
Medium
CVE-2015-9312
The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
Medium
CVE-2015-9311
The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
Critical
CVE-2017-18515
The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.
2019-08-13
Medium
CVE-2017-18488
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
Medium
CVE-2017-18487
The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.
Medium
CVE-2016-10867
The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
Medium
CVE-2016-10866
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
High
CVE-2018-20964
The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.
Medium
CVE-2018-20963
The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.
Medium
CVE-2017-18507
The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.
Medium
CVE-2017-18498
The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.
Medium
CVE-2017-18497
The liveforms plugin before 3.4.0 for WordPress has XSS.
Medium
CVE-2017-18496
The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.
Medium
CVE-2017-18495
The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.
Medium
CVE-2017-18494
The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.
Medium
CVE-2017-18493
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.
Medium
CVE-2017-18492
The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
Medium
CVE-2017-18491
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
Medium
CVE-2017-18490
The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.
Medium
CVE-2017-18489
The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.
Medium
CVE-2016-10871
The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
Medium
CVE-2016-10870
The google-language-translator plugin before 5.0.06 for WordPress has XSS.
Medium
CVE-2016-10869
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
Medium
CVE-2016-10868
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
Medium
CVE-2015-9302
The simple-fields plugin before 1.4.11 for WordPress has XSS.
Critical
CVE-2015-9301
The liveforms plugin before 3.2.0 for WordPress has SQL injection.
Medium
CVE-2015-9300
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
Medium
CVE-2015-9299
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
Critical
CVE-2015-9298
The events-manager plugin before 5.6 for WordPress has code injection.
Medium
CVE-2015-9297
The events-manager plugin before 5.6 for WordPress has XSS.
Medium
CVE-2015-9296
The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Medium
CVE-2015-9295
The contact-form-plugin plugin before 3.96 for WordPress has XSS.
Medium
CVE-2015-9294
The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
Medium
CVE-2015-9293
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
Medium
CVE-2013-7475
The contact-form-plugin plugin before 3.52 for WordPress has XSS.
Medium
CVE-2012-6713
The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.
2019-08-12
Medium
CVE-2019-14947
The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.
Medium
CVE-2019-14946
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.
Medium
CVE-2019-14945
The ultimate-member plugin before 2.0.54 for WordPress has XSS.
Medium
CVE-2018-20966
The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.
Medium
CVE-2018-20965
The ultimate-member plugin before 2.0.4 for WordPress has XSS.
Medium
CVE-2017-18505
The twitter-plugin plugin before 2.55 for WordPress has XSS.
High
CVE-2017-18504
The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.
Medium
CVE-2017-18503
The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.
Medium
CVE-2017-18502
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.
Medium
CVE-2017-18501
The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.
Medium
CVE-2017-18500
The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.
Medium
CVE-2017-18499
The simple-membership plugin before 3.5.7 for WordPress has XSS.
Medium
CVE-2016-10872
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
Medium
CVE-2015-9304
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Medium
CVE-2015-9303
The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
Medium
CVE-2019-14950
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.
Medium
CVE-2019-14949
The wp-database-backup plugin before 5.1.2 for WordPress has XSS.
Medium
CVE-2019-14948
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.
Medium
CVE-2017-18508
The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.
Medium
CVE-2017-18506
The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.
Medium
CVE-2016-10879
The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.
Medium
CVE-2016-10878
The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.
Medium
CVE-2016-10877
The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.
High
CVE-2016-10876
The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
Medium
CVE-2016-10875
The wp-database-backup plugin before 4.3.1 for WordPress has XSS.
High
CVE-2016-10874
The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
Medium
CVE-2016-10873
The wp-database-backup plugin before 4.3.3 for WordPress has XSS.
Medium
CVE-2015-9306
The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
Medium
CVE-2015-9305
The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
2019-08-09
Critical
CVE-2019-14801
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.
Medium
CVE-2019-14798
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
Medium
CVE-2019-14797
The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.
Medium
CVE-2019-14796
The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_lim…
High
CVE-2019-14794
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.
Medium
CVE-2019-14791
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
Medium
CVE-2019-14799
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
Medium
CVE-2019-14793
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
Medium
CVE-2019-14792
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.
Medium
CVE-2019-14787
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
Medium
CVE-2019-14785
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id paramete…
Medium
CVE-2016-10865
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
2019-08-08
Medium
CVE-2019-14774
The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter.
High
CVE-2019-14773
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.
Medium
CVE-2019-14683
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
Medium
CVE-2019-14682
The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.
High
CVE-2019-14681
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.
Medium
CVE-2019-14680
The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.
Medium
CVE-2019-14679
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
2019-08-06
Critical
CVE-2019-14695
A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQ…
2019-08-05
Critical
CVE-2019-14348
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid parameter.
2019-08-01
Critical
CVE-2019-13572
The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection.
2019-07-30
Critical
CVE-2019-14313
A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQ…
Medium
CVE-2019-14327
A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.
Critical
CVE-2019-13635
The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.
2019-07-29
Critical
CVE-2019-13571
A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute a…
Medium
CVE-2019-6726
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_folder_recursively in wpFastestCache.php…
2019-07-28
Medium
CVE-2019-14364
An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using th…
High
CVE-2019-14328
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
2019-07-23
High
CVE-2019-13570
The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection.
High
CVE-2019-1010209
GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload executable file in website. The component is: gourl.php#L56…
Medium
CVE-2019-1010124
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-…
2019-07-21
Critical
CVE-2019-14231
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the ob_get_results ajax nopriv handler due to there being no s…
Critical
CVE-2019-14230
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set_count ajax nopriv handler due to there being no sanitizati…