CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 110)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Podcast Importer SecondLine
≤1.5.6Update to 1.5.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate FAQ Accordion Plugin
≤2.4.14Update to 2.5.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Core Web Vitals & PageSpeed Booster
≤1.0.31Update to 1.0.32
- Medium5.3Missing Authorization
PayPlus Payment Gateway
≤8.2.5Update to 8.2.6
- Critical9.8Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
Paytium: Mollie payment forms & donations
≤5.0.3Update to 5.0.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Tainacan
≤1.2.0Update to 1.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Razorpay Payment Button Plugin
≤2.4.9Update to 2.5.0
- Medium5.3Missing Authorization
Online Booking & Scheduling Calendar by vcita
≤4.6.0Update to 4.6.3
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Reycob Product Import Export
≤2.3.0Update to 2.4.0
- Medium5.3Missing Authorization
Tangible: Loops & Logic
≤4.2.4Update to 4.3.0
- Medium5.3Missing Authorization
Conekta Payment Gateway
≤6.2.4Update to 6.2.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Mang Board
≤2.4.1Update to 2.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Photo Album Plus
≤9.3.02.002Update to 9.3.02.003
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
wpForo Forum
≤3.1.5Update to 3.1.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.1.1Update to 5.5.1.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Event Tickets and Registration
≤5.29.4Update to 5.29.5
- High7.2Unauthenticated Stored Cross-Site Scripting
WPS Limit Login
≤1.5.9.3Update to 1.5.9.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
PixelYourSite – Your smart PIXEL (TAG) & API Manager
≤11.4.1Update to 11.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- Medium5.3Missing Authorization
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)
≤3.15.4Update to 3.15.5
- Medium4.9Authenticated (Editor+) SQL Injection
Ultimeter – the Ultimate Progress and Goals Meter
≤3.0.8Update to 3.1.0
- Medium4.9Authenticated (Administrator+) SQL Injection
Email Log
≤2.63Update to 2.64
- Medium6.5Authenticated (Contributor+) SQL Injection
WP EasyCart: Shopping Cart and eCommerce Store
≤5.9.4Update to 6.0.0
- Medium6.5Authenticated (Contributor+) SQL Injection
Mollie Forms
≤2.11.0Update to 2.11.1
- Medium6.5Authenticated (Contributor+) SQL Injection
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator
≤1.5.10Update to 1.5.11
- Medium4.3Missing Authorization
Fluent Support – Helpdesk & Customer Support Ticket System
≤2.3.2Update to 2.4.0
- Medium4.9Authenticated (Shop Manager+) SQL Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.0Update to 3.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Blocks – Gutenberg Blocks, Patterns & Templates
≤2.3.17Update to 2.3.18
- High8.8Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields
Import and export users and customers
≤2.4.17Update to 2.4.18
- Medium5.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.70Update to 2.1.72