CWE-200Vulnerability type

WordPress Information Exposure vulnerabilities (page 1265)

Debug logs, backups and exports left reachable without authentication.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Information Exposure vulnerabilities (page 1265)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Reflected Cross-Site Scripting via tab Parameter All 404 Redirect to Homepage<1.21Update to 1.21	CVE-2021-24326	—	Apr 16, 2021
High8.8	Cross-Site Request Forgery 404 SEO Redirection≤1.3Update to 1.4	CVE-2021-24324	—	Apr 16, 2021
Medium6.4	Stored Cross-Site Scripting Clever Addons for Elementor<2.1.0Update to 2.1.0	CVE-2021-24273	—	Apr 15, 2021
High7.1	XXE Injection WordPress<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1	CVE-2021-29447	—	Apr 15, 2021
Medium6.5	Sensitive Information Disclosure WordPress<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1	CVE-2021-29450	—	Apr 15, 2021
Medium5.4	Cross-Site Request Forgery to Stored Cross-Site Scripting fitness calculators≤1.9.5Update to 1.9.6	CVE-2021-24272	—	Apr 14, 2021
High8.8	Authenticated (Contributor+) Privilege Escalation The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates≤2.0.6Update to 2.0.7	CVE-2021-4331	—	Apr 14, 2021
Medium6.5	Authenticated (Contributor+) Arbitrary File Read The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates≤4.1.9Update to 2.0.7 or 4.1.10	CVE-2021-4332	—	Apr 14, 2021
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Rife Extensions & Templates for Elementor<1.1.6Update to 1.1.6	CVE-2021-24265	—	Apr 13, 2021
Critical9.1	Server-Side Request Forgery WP Smart Import : Import any XML File to WordPress<1.0.1Update to 1.0.1	CVE-2020-24147	—	Apr 13, 2021
Medium6.4	Contributor+ Stored Cross-Site Scripting JetWidgets For Elementor<1.0.9Update to 1.0.9	CVE-2021-24268	—	Apr 13, 2021
Medium5.4	Premium Addons for Elementor <=4.2.7 Contributor+ Stored Cross-Site Scripting Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates<4.2.8Update to 4.2.8	CVE-2021-24257	—	Apr 13, 2021
Medium6.4	Authenticated Stored Cross-Site Scripting ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin<1.8.6Update to 1.8.6	CVE-2021-24262	—	Apr 13, 2021
Medium6.5	Server-Side Request Forgery Podcast Importer SecondLine<1.1.5Update to 1.1.5	CVE-2020-24149	—	Apr 13, 2021
Medium5.4	Contributor+ Stored Cross-Site Scripting PowerPack Addons for Elementor: Widgets, Form Styler and Templates≤2.3.1Update to 2.3.2	CVE-2021-24263	—	Apr 13, 2021
Medium5.4	Authenticated (Contributor+) Stored Cross-Site Scripting ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor≤2.1.7Update to 2.2.0	CVE-2021-24258	—	Apr 13, 2021
Medium5.4	Authenticated Stored Cross-Site Scripting The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates<2.0.6Update to 2.0.6	CVE-2021-24266	—	Apr 13, 2021
Medium5.4	Authenticated Stored Cross-Site Scripting DethemeKit for Elementor<1.5.5.5Update to 1.5.5.5	CVE-2021-24270	—	Apr 13, 2021
Medium5.4	Stored Cross-Site Scripting Addon Elements for Elementor (formerly Elementor Addon Elements)<1.11.2Update to 1.11.2	CVE-2021-24259	—	Apr 13, 2021
High8.3	Server-Side Request Forgery Video Downloader for TikTok<1.4Update to 1.4	CVE-2020-24142	—	Apr 13, 2021
Medium6.1	Cross-Site Scripting CM Download Manager – Organize, Protect & Share Files in WordPress<2.8.0Update to 2.8.0	CVE-2020-24145	—	Apr 13, 2021
Medium6.4	WidgetKit <= 2.3.9 - Contributor+ Stored Cross-Site Scripting WidgetKit for Elementor – Lightweight Elementor Addons, Widgets & Templates<2.3.10Update to 2.3.10	CVE-2021-24267	—	Apr 13, 2021
Medium6.4	Stored Cross-Site Scripting Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder<1.5.8Update to 1.5.8	CVE-2021-24256	—	Apr 13, 2021
Medium5.4	Stored Cross-Site Scripting Ultimate Addons for Elementor<1.30.0Update to 1.30.0	CVE-2021-24271	—	Apr 13, 2021
Medium5.4	Livemesh Addons for Elementor <= 6.7.1- Contributor+ Stored Cross-Site Scripting Livemesh Addons by Elementor≤6.7.1Update to 6.8	CVE-2021-24260	—	Apr 13, 2021
Medium5.4	Absolute Addons for Elementor Page Builder <= 1.5.5 - Contributor+ Stored Cross-Site Scripting HT Mega Addons for Elementor – Elementor Widgets & Template Builder≤1.5.5Update to 1.5.7	CVE-2021-24261	—	Apr 13, 2021
Medium5.3	Server-Side Request Forgery WP-DownloadManager<1.68.5Update to 1.68.5	CVE-2020-24141	—	Apr 13, 2021
High8.1	Directory Traversal to Arbitrary File Deletion and Denial of Service CM Download Manager – Organize, Protect & Share Files in WordPress<2.8.0Update to 2.8.0	CVE-2020-24146	—	Apr 13, 2021
Medium6.4	Authenticated Stored Cross-Site Scripting Image Hover Effects – Elementor Addon<1.3.4Update to 1.3.4	CVE-2021-24264	—	Apr 13, 2021
Medium5.4	Stored Cross-Site Scripting Sina Extension for Elementor<3.3.12Update to 3.3.12	CVE-2021-24269	—	Apr 13, 2021

Medium6.1
Reflected Cross-Site Scripting via tab Parameter
All 404 Redirect to Homepage
<1.21Update to 1.21
CVE-2021-24326Apr 16, 2021
High8.8
Cross-Site Request Forgery
404 SEO Redirection
≤1.3Update to 1.4
CVE-2021-24324Apr 16, 2021
Medium6.4
Stored Cross-Site Scripting
Clever Addons for Elementor
<2.1.0Update to 2.1.0
CVE-2021-24273Apr 15, 2021
High7.1
XXE Injection
WordPress
<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1
CVE-2021-29447Apr 15, 2021
Medium6.5
Sensitive Information Disclosure
WordPress
<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1
CVE-2021-29450Apr 15, 2021
Medium5.4
Cross-Site Request Forgery to Stored Cross-Site Scripting
fitness calculators
≤1.9.5Update to 1.9.6
CVE-2021-24272Apr 14, 2021
High8.8
Authenticated (Contributor+) Privilege Escalation
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤2.0.6Update to 2.0.7
CVE-2021-4331Apr 14, 2021
Medium6.5
Authenticated (Contributor+) Arbitrary File Read
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤4.1.9Update to 2.0.7 or 4.1.10
CVE-2021-4332Apr 14, 2021
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Rife Extensions & Templates for Elementor
<1.1.6Update to 1.1.6
CVE-2021-24265Apr 13, 2021
Critical9.1
Server-Side Request Forgery
WP Smart Import : Import any XML File to WordPress
<1.0.1Update to 1.0.1
CVE-2020-24147Apr 13, 2021
Medium6.4
Contributor+ Stored Cross-Site Scripting
JetWidgets For Elementor
<1.0.9Update to 1.0.9
CVE-2021-24268Apr 13, 2021
Medium5.4
Premium Addons for Elementor <=4.2.7 Contributor+ Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
<4.2.8Update to 4.2.8
CVE-2021-24257Apr 13, 2021
Medium6.4
Authenticated Stored Cross-Site Scripting
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
<1.8.6Update to 1.8.6
CVE-2021-24262Apr 13, 2021
Medium6.5
Server-Side Request Forgery
Podcast Importer SecondLine
<1.1.5Update to 1.1.5
CVE-2020-24149Apr 13, 2021
Medium5.4
Contributor+ Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤2.3.1Update to 2.3.2
CVE-2021-24263Apr 13, 2021
Medium5.4
Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤2.1.7Update to 2.2.0
CVE-2021-24258Apr 13, 2021
Medium5.4
Authenticated Stored Cross-Site Scripting
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
<2.0.6Update to 2.0.6
CVE-2021-24266Apr 13, 2021
Medium5.4
Authenticated Stored Cross-Site Scripting
DethemeKit for Elementor
<1.5.5.5Update to 1.5.5.5
CVE-2021-24270Apr 13, 2021
Medium5.4
Stored Cross-Site Scripting
Addon Elements for Elementor (formerly Elementor Addon Elements)
<1.11.2Update to 1.11.2
CVE-2021-24259Apr 13, 2021
High8.3
Server-Side Request Forgery
Video Downloader for TikTok
<1.4Update to 1.4
CVE-2020-24142Apr 13, 2021
Medium6.1
Cross-Site Scripting
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
CVE-2020-24145Apr 13, 2021
Medium6.4
WidgetKit <= 2.3.9 - Contributor+ Stored Cross-Site Scripting
WidgetKit for Elementor – Lightweight Elementor Addons, Widgets & Templates
<2.3.10Update to 2.3.10
CVE-2021-24267Apr 13, 2021
Medium6.4
Stored Cross-Site Scripting
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder
<1.5.8Update to 1.5.8
CVE-2021-24256Apr 13, 2021
Medium5.4
Stored Cross-Site Scripting
Ultimate Addons for Elementor
<1.30.0Update to 1.30.0
CVE-2021-24271Apr 13, 2021
Medium5.4
Livemesh Addons for Elementor <= 6.7.1- Contributor+ Stored Cross-Site Scripting
Livemesh Addons by Elementor
≤6.7.1Update to 6.8
CVE-2021-24260Apr 13, 2021
Medium5.4
Absolute Addons for Elementor Page Builder <= 1.5.5 - Contributor+ Stored Cross-Site Scripting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
≤1.5.5Update to 1.5.7
CVE-2021-24261Apr 13, 2021
Medium5.3
Server-Side Request Forgery
WP-DownloadManager
<1.68.5Update to 1.68.5
CVE-2020-24141Apr 13, 2021
High8.1
Directory Traversal to Arbitrary File Deletion and Denial of Service
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
CVE-2020-24146Apr 13, 2021
Medium6.4
Authenticated Stored Cross-Site Scripting
Image Hover Effects – Elementor Addon
<1.3.4Update to 1.3.4
CVE-2021-24264Apr 13, 2021
Medium5.4
Stored Cross-Site Scripting
Sina Extension for Elementor
<3.3.12Update to 3.3.12
CVE-2021-24269Apr 13, 2021