CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 109)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Insecure Direct Object Reference
Sprout Invoices – Client Invoicing & Estimates
≤20.8.17Update to 20.8.18
- High8.8Authenticated (Contributor+) Remote Code Execution
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤3.2.0Update to 3.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.85Update to 51.1.86
- Medium6.5Authenticated (Editor+) Arbitrary File Deletion
Template Kit – Import
≤1.0.16Update to 1.0.17
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Import and export users and customers
≤2.5.2Update to 2.5.4
- High7.5Unauthenticated Arbitrary File Read
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.5.0Update to 4.5.1
- High7.5Authenticated (Contributor+) PHP Object Injection
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.33.6Update to 2.34.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
≤1.10.7Update to 1.10.8
- Medium6.1Reflected Cross-Site Scripting
File Manager
≤8.0.4Update to 8.0.5
- Medium6.52.0.2 - Unauthenticated Arbitrary Shortcode Execution
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
1.5.0.1 – 2.0.2Update to 2.0.2.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Review Slider Pro
≤12.7.11Update to 12.7.12
- Medium4.3Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
MailerLite – Signup forms (official)
≤1.7.21Update to 1.7.22
- Medium6.5Missing Authorization to Unauthenticated Settings Export and Settings Reset
Custom Thank You Page for WooCommerce
≤1.1.2Update to 1.1.3
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
Spectra Legacy – Gutenberg Blocks
≤2.20.0Update to 2.20.1
- Medium5.4Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.0Update to 6.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
WP Multilang – Translation and Multilingual Plugin
≤2.4.31Update to 2.4.32
- Critical9.8Unauthenticated Local File Inclusion via 'vcv-template' Parameter
Visual Composer Website Builder
≤45.16.0Update to 45.16.1
- High8.8Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
YOP Poll
≤7.0.10Update to 7.0.11
- High7.5Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter
eesy_ID2WP – Publish InDesign HTML5
≤1.0.3Update to 1.0.4
- Medium4.9Authenticated (Editor+) SQL Injection
W4 Post List
≤3.0.6Update to 3.0.7
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP
≤2.1.7Update to 2.1.8
- Medium5.3Unauthenticated Insecure Direct Object Reference
Team – Team Members Showcase Plugin
≤6.0.0Update to 6.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.69Update to 3.1.70
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetTricks
≤2.0.1Update to 2.0.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.8Update to 3.7.9
- Medium4.3Cross-Site Request Forgery
PublishPress Capabilities: User Role Access Control, Admin Area Permissions
≤2.50.1Update to 2.51.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.5Update to 7.9.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.105Update to 4.11.106
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤4.0.5Update to 4.0.6