CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 107)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint
OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA
≤1.1.7Update to 1.1.8
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter
Customer Reviews for WooCommerce
≤5.120.0Update to 5.121.0
- Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤3.0.4Update to 3.0.5
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤3.0.4Update to 3.0.5
- Critical9.1Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium5.3Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers
Blog2Social: Social Media Auto Post & Scheduler
≤9.1.0Update to 9.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting via first_name Parameter
BA Book Everything
≤1.8.27Update to 1.8.28
- Critical9.8Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
Wawp Country Code & Chat Widget for WooCommerce
≤4.8.6Update to 4.8.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation
AMP for WP – Accelerated Mobile Pages
≤1.1.16Update to 1.1.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode
CSS & JavaScript Toolbox
≤12.0.6Update to 12.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job
Fancy Product Designer
≤6.5.2Update to 6.5.3
- Medium4.3Authenticated (Subscriber+) Information Exposure
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- High7.5Authenticated (Subscriber+) PHP Object Injection
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
≤6.5.5Update to 6.5.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Product Table & List Builder for WooCommerce
≤5.6.7Update to 5.6.9
- Medium5.3Missing Authorization
Testimonials Widget
≤4.0.4No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
YITH WooCommerce Ajax Search
≤2.28.0Update to 2.28.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Simply Schedule Appointments
≤1.6.12.31Update to 1.6.12.33
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.27Update to 6.4.28
- Medium4.3Authenticated (Contributor+) Information Exposure
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Review Slider Pro
≤12.7.11Update to 12.7.12
- Medium4.3Missing Authorization
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium6.3Authenticated (Shop Worker+) Privilege Escalation
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.7.2Update to 4.7.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
ThemeREX Addons
<2.45.0Update to 2.45.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
≤1.26.15Update to 1.26.16
- Medium4.3Cross-Site Request Forgery
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification
≤2.3.1Update to 2.3.2
- Medium6.6Authenticated (Editor+) PHP Object Injection
Ultra Addons for Contact Form 7
≤3.5.51Update to 3.5.52
- Medium6.3Authenticated (Subscriber+) Security Control Bypass
All-In-One Security (AIOS) – Security and Firewall
≤5.4.8Update to 5.4.9
- Medium5.3Missing Authorization
Customer Reviews for WooCommerce
≤5.120.0Update to 5.121.0