CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 104)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.0.12Update to 2.0.15
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.3.9Update to 6.4.0
- Medium4.3Missing Authorization
MakeCommerce for WooCommerce
≤4.1.0Update to 4.1.1
- Medium5.3Unauthenticated Information Exposure
WPMobile.App – Android and iOS App Builder
≤11.83Update to 11.84
- Medium4.32.1.3 - Missing Authorization
Media Library Organizer – Folders, File Manager & Media Categories
2.0.4 – 2.1.3Update to 2.1.4
- Medium5.31.4.0 - Unauthenticated Information Exposure
YayReviews – Advanced Customer Reviews for WooCommerce
1.0.4 – 1.4.0Update to 1.4.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Notification for Telegram
≤3.5.2Update to 3.5.3
- Medium4.7Authenticated (Administrator+) Cross-Site WebP File Deletion or Rename
EWWW Image Optimizer
≤8.7.0Update to 8.8.0
- Medium5.3Unauthenticated Arbitrary Gift Card Price Manipulation
WebToffee Gift Cards for WooCommerce
≤1.3.0Update to 1.3.1
- Medium4.3Missing Authorization
Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF
≤2.0.7Update to 2.0.8
- Medium4.3Missing Authorization
All in One Files Upload for WooCommerce
≤2.0.16Update to 2.0.17
- Medium6.56.17.5 - Unauthenticated Arbitrary Shortcode Execution
The Events Calendar
6.12.0 – 6.17.5Update to 6.17.5.1
- High7.34.3.11 - Unauthenticated Privilege Escalation
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
3.5.29 – 4.3.11Update to 4.3.12
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Content Egg – Affiliate Product Importer & Price Comparison
≤6.3.1Update to 11.9.0
- High7.5Authenticated (Contributor+) PHP Object Injection
DesignSetGo
≤2.8.0Update to 2.8.1
- Medium4.3Authenticated (Subscriber+) Information Exposure
Image Optimizer
≤1.7.6Update to 1.7.7
- High7.22.0.7 - Unauthenticated Stored Cross-Site Scripting
Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF
2.0.0 – 2.0.7Update to 2.0.8
- Medium6.41.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Hostinger Reach – AI-Powered Email Marketing for WordPress
1.0.6 – 1.8.2Update to 1.8.3
- High7.22.0.16 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
All in One Files Upload for WooCommerce
2.0.3 – 2.0.16Update to 2.0.17
- Medium6.41.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Audio Player Block – Advanced Block for Embedding Audio Files
1.1.0 – 1.6.2Update to 1.6.3
- Medium6.44.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
EmbedPress
4.4.9 – 4.6.6Update to 4.6.7
- Critical9.8Unauthenticated Arbitrary File Upload
zella-theme
≤2.6.2Update to 2.6.3
- Medium5.34.3.11 - Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
2.5.8 – 4.3.11Update to 4.3.12
- High7.3Unauthenticated Unauthorized Customer Account Access
FluentCart – Online Store Builder & eCommerce Checkout
≤1.6.4Update to 1.6.5
- Medium5.3Unauthenticated Information Exposure
Course Booking System
≤7.0.8Update to 7.0.9
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
Vitepos – Point of Sale (POS) for WooCommerce
≤3.5.0Update to 3.5.1
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Cost of Goods: Product Cost & Profit Calculator for WooCommerce
≤3.5.2Update to 4.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Verge3D Publishing and E-Commerce
≤4.13.0Update to 4.13.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Content Egg – Affiliate Product Importer & Price Comparison
≤11.8.0Update to 11.9.0
- High7.58.7.7 - Authenticated (Author+) PHP Object Injection
EWWW Image Optimizer
8.6.0 – 8.7.7Update to 8.8.0