CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 105)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Arbitrary File Upload via Signature Form Field
Ultra Addons for Contact Form 7
≤3.5.50Update to 3.5.51
- Critical9.8Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter
miniOrange OTP Login, Verification and SMS Notifications
≤5.5.5Update to 5.5.6
- High8.8Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode
Groups – Memberships and Access Control
≤4.6.0Update to 4.7.0
- Critical9.8Unauthenticated Arbitrary File Upload via AJAX Popup Handler
Request a Quote for WooCommerce
≤2.9.2No patch available
- Medium6.4Unauthenticated Stored Cross-Site Scripting via REQUEST_URI
Automatic.css
4.0.0 – 4.0.0Update to 4.0.1
- High8.84.3.1 - Cross-Site Request Forgery via REST Nonce Bypass to Privilege Escalation
Elementor Website Builder – more than just a page builder
4.3.0 – 4.3.1Update to 4.3.2
- Medium6.48.7.5 - Authenticated (Author+) Stored Cross-Site Scripting
Optima Express IDX
8.6.0 – 8.7.5Update to 8.7.6
- Medium5.3Missing Authorization
WP Verify API
≤1.0.0No patch available
- Medium4.3Authenticated (Staff+) Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPress Podcasting plugin by Blubrry
≤11.17.1Update to 11.17.2
- Medium4.3Missing Authorization
NextScripts: Social Networks Auto-Poster
≤4.4.7Update to 4.4.8
- Medium5.38.7.5 - Missing Authorization
Optima Express IDX
8.5.0 – 8.7.5Update to 8.7.6
- Medium6.5Missing Authorization
Malcure Malware Shield — Removal, Repair, Monitor
≤19.9.6Update to 19.9.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP YouTube Lyte
≤1.7.30Update to 1.7.31
- High7.5Unauthenticated SQL Injection
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤8.0.2Update to 8.0.3
- High7.5Unauthenticated SQL Injection
SPS-Suite
≤1.4.0No patch available
- Medium5.34.13.0 - Missing Authorization
Verge3D Publishing and E-Commerce
4.1.0 – 4.13.0Update to 4.13.1
- Medium5.3Unauthenticated Information Exposure
Verge3D Publishing and E-Commerce
≤4.13.0Update to 4.13.1
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
WPeMatico RSS Feed Fetcher
≤2.8.26Update to 2.8.27
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
WPeMatico RSS Feed Fetcher
≤2.8.26Update to 2.8.27
- Medium4.32.3.1 - Blocked User Restriction Bypass
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification
1.3.0 – 2.3.1Update to 2.3.2
- Medium5.3Unauthenticated Payment Bypass
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Download Manager
≤7.5.5Update to 7.5.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
EmbedPress
≤4.6.6Update to 4.6.7
- Medium6.42.8.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
2.8.12 – 2.8.18Update to 2.8.19
- Medium5.3Unauthenticated Insecure Direct Object Reference
Mailchimp for WooCommerce
≤6.2Update to 6.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
Post Voting System
≤1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPeMatico RSS Feed Fetcher
≤2.8.26Update to 2.8.27
- High7.528.2 - Authenticated (Bookly Administrator+) PHP Object Injection
Online Scheduling and Appointment Booking System – Bookly
23.2 – 28.2Update to 28.3