CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1264)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Admin+ Stored Cross-Site Scripting
Smooth Page Scroll Up/Down Buttons
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
Redirect 404 to parent
<1.3.1Update to 1.3.1
- Medium5.5Admin+ Stored Cross-Site Scripting
RSS for Yandex Turbo
≤1.30Update to 1.31
- Medium5.3Arbitrary Options Update
Thrive Leads
<2.3.9.4Update to 2.3.9.4
- Medium6.1Reflected Cross-Site Scripting
Select All Categories and Taxonomies, Change Checkbox to Radio Buttons
<1.3.2Update to 1.3.2
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
WP Content Copy Protection & No Right Click
<3.1.5Update to 3.1.5
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Tree Sitemap (Pages, Posts & Categories list)
<2.9Update to 2.9
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Captchinoo, admin login page protection with Google recaptcha
≤2.3Update to 2.4
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
WP Maintenance Mode & Site Under Construction
<1.8.2Update to 1.8.2
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Limit Login Attempts (Spam Protection)
<2.9Update to 2.9
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Login as User or Customer — User Switching
<1.8Update to 1.8
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Visitor Traffic Real Time Statistics
≤2.11Update to 2.12
- High8.8Improper Authorization
WP Maintenance Mode & Site Under Construction
<1.5.2Update to 1.5.2
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WooCommerce
<5.2.0Update to 5.2.0
- Medium6.1Reflected Cross-Site Scripting
Accordions
<2.2.30Update to 2.2.30
- Medium5.5Authenticated Stored Cross-Site Scripting
RSS for Yandex Turbo
≤1.29Update to 1.30
- High8.8Authenticated PHP Object Injection
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Critical9.8Arbitrary File Upload
Kaswara Modern VC Addons
≤3.0.1No patch available
- High7.5Unauthenticated Arbitrary Nonce Generation
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.5Authenticated Arbitrary Plugin Installation
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium4.3Authenticated Arbitrary Post Deletion
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.3Unprotected AJAX Actions
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.1Reflected Cross-Site Scripting <= 1.5.68 - Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- Medium6.1Multiple Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.69Update to 1.5.69
- Medium6.1Reflected Cross-Site scripting
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
≤1.2.4Update to 1.2.5
- Medium6.1Reflected Cross-Site scripting
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.14Update to 1.7.15
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- Medium6.1Reflected Cross-Site Scripting
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.10.4Update to 1.10.5
- High8.8Cross-Site Request Forgery
404 SEO Redirection
≤1.3Update to 1.4
- Medium4.8Authenticated Stored Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
≤6.4Update to 7.1