CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1258)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Newspaper Lite
≤10.3.9.1Update to 11.0
- High8.8Blind SQL Injection
Portfolio Responsive Gallery
≤1.1.7Update to 1.1.8
- High8.8SQL Injection
Popup Like box – Page Plugin
≤3.5.2Update to 3.5.3
- High7.2Responsive Image Gallery <= 4.4.3 - Authenticated Blind SQL Injections
Photo Gallery by Ays – Responsive Image Gallery
<4.4.4Update to 4.4.4
- High8.8SQL Injection
Image Slider by Ays- Responsive Slider and Carousel
<2.5.0Update to 2.5.0
- High8.1Authorization Bypass
Workreap - Freelance Marketplace and Directory WordPress Theme
<2.2.2Update to 2.2.2
- Medium5.4Stored Cross-Site Scripting
WP Offload SES Lite
≤1.4.4Update to 1.4.5
- Low2.7Server-Side Request Forgery
RSVPMaker
<8.7.3Update to 8.7.4
- High8.8Authenticated SQL Injection
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
<2.3.4Update to 2.3.4
- High7.2SQL Injection
Quiz Maker by AYS
<6.2.0.9Update to 6.2.0.9
- High7.2SQL Injection
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
<3.2.1Update to 3.2.1
- High8.8Authenticated SQL Injection
Survey Maker by AYS
<1.5.6Update to 1.5.6
- High7.2SQL Injection
Secure Copy Content Protection and Content Locking
<2.6.7Update to 2.6.7
- High8.8Blind SQL Injection
FAQ Builder AYS
≤1.3.5Update to 1.3.6
- High8.8Authenticated SQL Injection
Handsome Testimonials & Reviews
<2.1.1Update to 2.1.1
- Critical9.83.1.3 - Unauthenticated Privilege Escalation
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
3.0.0 – 3.1.3Update to 3.1.4
- Critical9.83.1.3 - Arbitrary File Upload
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
3.0.0 – 3.1.3Update to 3.1.4
- High7.2SQL Injection
Side Menu Lite – Sticky Floating Side Menu
≤2.1.1Update to 2.2.1
- Medium5.4Stored Cross-Site Scripting
Yada Wiki
<3.4.1Update to 3.4.1
- Critical9.83.1.3 - Unauthenticated Privilege Escalation
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
3.0.0 – 3.1.3Update to 3.1.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Event Geek
≤2.5.2No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Steam Group Viewer
≤2.1No patch available
- Medium4.3Cross-Site Request Forgery Bypass
Edwiser Bridge – WordPress Moodle Integration
≤2.0.6Update to 2.0.7
- Medium6.4Contributor+ Stored Cross-Site Scripting
YouTube Embed, Playlist and Popup by WpDevArt
<2.3.9Update to 2.3.9
- Medium5.5Authenticated Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
≤1.9.1Update to 1.9.2
- Critical9.8Server-Side Request Forgery & Remote File Inclusion
Onair2: Radio Station WordPress Theme With Non-Stop Music Player
<3.9.9.2Update to 3.9.9.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Bookshelf
≤2.0.4No patch available
- Medium6.4Stored Cross-Site Scripting
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
≤1.0.6Update to 1.0.7
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Migrate Users
≤1.0.1No patch available
- Medium6.1Reflected Cross-Site Scripting via extension
W3 Total Cache
<2.1.4Update to 2.1.4