CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 108)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Server-Side Request Forgery
Testimonials Widget
≤4.0.4No patch available
- Medium6.44.2.12 - Authenticated (Author+) Stored Cross-Site Scripting
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
4.0.0 – 4.2.12Update to 4.2.13
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Estatik Real Estate Plugin
≤4.3.5Update to 4.3.6
- High7.5Unauthenticated Denial of Service
WP Store Locator
<3.0.0Update to 3.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing
≤1.69.0Update to 1.69.1
- Medium5.3Missing Authorization
Simply Schedule Appointments
≤1.6.12.29Update to 1.6.12.31
- High8.15.3.6 - Unauthenticated Local File Inclusion
WebFacing™ – Email Accounts management for cPanel®
5.3 – 5.3.6Update to 5.4
- Medium5.38.0.4 - Unauthenticated Information Exposure
File Manager
7.2.2 – 8.0.4Update to 8.0.5
- Medium6.4Authenticated (Listing Admin+) Stored Cross-Site Scripting
WP Directory Kit
≤1.5.7Update to 1.5.8
- Medium5.3Missing Authorization
Blocksy Companion
≤2.1.55Update to 2.1.56
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.14.3Update to 3.8.15
- High7.2Unauthenticated Stored Cross-Site Scripting
ThemeREX Addons
<2.45.0Update to 2.45.0
- Medium5.3Unauthenticated User Impersonation
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- High7.2Unauthenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤6.5.1Update to 6.5.2
- Medium4.3Cross-Site Request Forgery
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium5.3Missing Authorization
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.2Update to 4.0.3
- High7.5Authenticated (Contributor+) PHP Object Injection
Go Live Update Urls
≤7.0.8Update to 7.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤8.3.1Update to 8.3.2
- High7.5Authenticated (Contributor+) PHP Object Injection
GEO Plugin by Squirrly SEO
≤14.2.5Update to 14.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.13Update to 14.16.14
- High7.2Unauthenticated Stored Cross-Site Scripting
Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیت
≤6.3Update to 6.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP Review Slider Pro
≤12.7.11Update to 12.7.12
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Kadence WooCommerce Email Designer
≤1.5.19.1Update to 1.5.19.2
- High7.2Unauthenticated Stored Cross-Site Scripting
LayerSlider
≤8.4.0Update to 8.4.1
- Medium5.3Unauthenticated Payment Bypass
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.6.25Update to 4.6.26
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JetEngine
≤3.8.14.3Update to 3.8.15
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar
≤6.5.0Update to 6.5.2