VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-200Vulnerability type

WordPress Information Exposure vulnerabilities (page 10)

Debug logs, backups and exports left reachable without authentication.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Information Exposure vulnerabilities (page 10)
SeverityVulnerabilityCVEInstallsPublished
High7.5Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI≤6.0.4Update to 6.0.5
CVE-2026-104768—
High7.2Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission≤4.3.13Update to 4.3.14
CVE-2026-109214—
High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta
Motors – Car Dealership & Classified Listings Plugin≤1.4.125Update to 1.4.126
CVE-2026-104746—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot≤2.6.1Update to 2.6.2
CVE-2026-104760—
High7.2Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker Parameters
WP Visitor Statistics (Real Time Traffic)≤8.9.0Update to 8.9.1
CVE-2026-111370—
High7.3Unauthenticated Privilege Escalation
ACF Frontend Admin by DynamiApps≤3.30.1Update to 3.30.2
CVE-2026-119506—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hook
Falang multilanguage for WordPress≤1.4.6Update to 1.4.7
CVE-2026-118047—
Critical9.1Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.6Update to 5.7.7
CVE-2026-118066—
High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter
FunnelKit Payment Gateway for Stripe WooCommerce≤1.15.0.2Update to 1.16.0
CVE-2026-109991—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field
WP-Members Membership Plugin≤3.5.7Update to 3.5.8
CVE-2026-96565—
Medium6.5Authenticated (Subscriber+) SQL Injection via 'q' Parameter
Dynific Addons for Elementor (formerly Anywhere Elementor)≤1.3Update to 1.3.1
CVE-2026-103914—
High7.2Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source
JetFormBuilder — Dynamic Blocks Form Builder≤3.6.7Update to 3.6.7.1
CVE-2026-111317—
Medium6.5Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer
Dynific Addons for Elementor (formerly Anywhere Elementor)≤1.3.0Update to 1.3.1
CVE-2026-102564—
Medium5.3Missing Authorization
MC4WP: Mailchimp for WordPress≤4.14.1Update to 4.15.0
CVE-2026-27356—
Medium4.3Missing Authorization
Polylang≤3.9Update to 3.9.1
CVE-2026-122670—
Medium4.3Missing Authorization
Royal Addons for Elementor – Addons and Templates Kit for Elementor≤1.7.1068Update to 1.7.1069
CVE-2026-119519—
High7.2Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' Parameter
Happyforms Pro≤1.38.9Update to 1.38.10
CVE-2026-93766—
High7.2Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For Header
Happyforms Pro≤1.38.9Update to 1.38.10
CVE-2026-93755—
High7.2Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameter
Link Library≤7.10.0Update to 7.10.1
CVE-2026-116537—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter
Modula Image Gallery – Photo Grid & Video Gallery≤3.0.17Update to 3.0.18
CVE-2026-121976—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property
JetFormBuilder — Dynamic Blocks Form Builder≤3.6.8Update to 3.6.8.1
CVE-2026-121977—
High7.2Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta
JetFormBuilder — Dynamic Blocks Form Builder≤3.6.8Update to 3.6.8.1
CVE-2026-119183—
High7.2Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter
Church Admin≤5.1.7Update to 5.1.8
CVE-2026-123418—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message
Football Pool≤2.13.5Update to 2.13.6
CVE-2026-118050—
Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute
WP ImageViewer≤3.0.2Update to 3.0.3
CVE-2026-122059—
Critical9.8Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout
Registration Form for WooCommerce≤1.1.4Update to 1.1.5
CVE-2026-119075—
High8.1Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps≤5.5.89Update to 5.5.90
CVE-2026-118267—
Medium4.7Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter
Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials≤4.1.0Update to 4.1.1
CVE-2026-120509—
High7.2Unauthenticated Stored Cross-Site Scripting via 'browser' Parameter
WP Visitor Statistics (Real Time Traffic)≤8.7.1Update to 8.8
CVE-2026-109230—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter
Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials≤4.1.0Update to 4.1.1
CVE-2026-120683—

Search VulnCrest Radar

Jump to

Are you sure?