CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 103)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.41.10.1 - Authenticated (Editor+) Stored Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
1.9.9 – 1.10.1Update to 1.10.2
- Medium6.11.10.1 - Reflected Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
1.8 – 1.10.1Update to 1.10.2
- High7.5Unauthenticated SQL Injection
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting
Tabs Responsive – With WooCommerce Product Tabs Extension
≤2.5No patch available
- High7.2HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
HT Contact Form – Drag & Drop Form Builder for WordPress
≤2.10.2Update to 2.10.3
- High8.8Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
ConvertPlus
≤3.6.3Update to 3.6.4
- Medium5.3Missing Authorization
WebToffee WP Backup and Migration
≤1.6.0Update to 1.6.1
- Medium4.7Unauthenticated Open Redirect
Safe Redirect Manager
≤2.2.0Update to 2.3.0
- High7.5Authenticated (Author+) PHP Object Injection
Minimum and Maximum Quantity for WooCommerce
≤2.1.2Update to 2.1.3
- Medium5.3Unauthenticated Unauthorized Subscription Activation
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.9Update to 3.1.0
- High8.1Unauthenticated PHP Object Injection
Booking Activities
≤1.18.7.1Update to 1.18.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Trusted Shops Easy Integration for WooCommerce
≤2.0.6Update to 2.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.3Update to 6.1.5
- High7.5Authenticated (Custom Role+) PHP Object Injection
eCommerce Product Catalog
≤3.6.0Update to 3.6.1
- High7.5Authenticated (Custom Role+) PHP Object Injection
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.9Update to 1.17.10
- Medium5.3Missing Authorization
GravityExport Lite for Gravity Forms
≤2.7.2Update to 2.7.3
- Medium5.31.9.7 - Missing Authorization
InPost PL
1.7.5 – 1.9.7Update to 1.9.8
- Medium6.12.8.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Mobile Menu – The Mobile-Friendly Responsive Menu
2.7.4 – 2.8.8Update to 2.9
- Medium5.32.0.6 - Unauthenticated Access Mode Bypass
WPEPP – All In One WordPress Security, Firewall, Malware Scanner & Login Protection
2.0.0 – 2.0.6Update to 2.0.7
- Medium4.3Missing Authorization
Vayu X
≤1.0.5Update to 1.0.6
- Medium5.3Unauthenticated Information Exposure
Connections Business Directory
≤10.4.67No patch available
- Medium5.33.2.9 - Unauthenticated Information Exposure
New User Approve
3.1.0 – 3.2.9Update to 3.2.10
- Medium5.3Unauthenticated Information Exposure
Solace Extra
≤1.7.1Update to 1.7.2
- Medium4.3Authenticated (Subscriber+) Subscription-Gated Post Creation
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium4.7Cross-Site Scripting to Unauthenticated Arbitrary HTML Content Injection in Admin Log
WP Mail Logging
≤1.16.0Update to 1.17.0
- Medium5.32.0.5 - Unauthenticated Arbitrary Payment Amount Reduction
Easy PayPal & Stripe Buy Now Button
1.8 – 2.0.5Update to 2.0.6
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Schema & Structured Data for WP & AMP
≤1.66Update to 1.67
- High7.22.0.0 - Unauthenticated Server-Side Request Forgery
Broken Link Notifier
1.3.1 – 2.0.0Update to 2.0.0.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
YITH WooCommerce Tab Manager
≤2.15.0Update to 2.15.1
- High7.5Authenticated (Contributor+) PHP Object Injection
Themify Builder
≤7.8.1Update to 7.8.2