CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1275)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery Bypass
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
<3.0.9Update to 3.0.9
- Medium4.3Cross-Site Request Forgery Bypass
10WebAnalytics
<1.2.9Update to 1.2.9
- Medium4.3Cross-Site Request Forgery Bypass
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
<3.4.3Update to 3.4.3
- Medium4.3Cross-Site Request Forgery Bypass
Coming Soon & Maintenance Mode Page & Under Construction
≤1.57Update to 1.58
- Medium4.3Cross-Site Request Forgery Bypass
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
<2.3.10Update to 2.3.10
- Medium4.3Cross-Site Request Forgery Bypass
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<2.4.3Update to 2.4.3
- Medium4.3Cross-Site Request Forgery Bypass
WebberZone Top 10 — Popular Posts
<2.9.5Update to 2.9.5
- Medium4.3Cross-Site Request Forgery Bypass
WP Hotel Booking
<1.10.2Update to 1.10.2
- Medium4.3Cross-Site Request Forgery Bypass
Product Catalog Simple
<1.5.13Update to 1.5.13
- Medium4.3Cross-Site Request Forgery Bypass
Menu Swapper
≤1.1.0.2Update to 1.1.1
- Medium4.3Cross-Site Request Forgery Bypass
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
<2.4.1Update to 2.4.1
- High8.8Cross-Site Request Forgery
Coming Soon & Maintenance Mode Page & Under Construction
≤1.57Update to 1.58
- Medium4.3Cross-Site Request Forgery Bypass
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
<1.8.3Update to 1.8.3
- Critical9.8SQL Injection
DiveBook
≤1.1.4No patch available
- Medium6.1Reflected Cross-Site Scripting
DiveBook
≤1.1.4No patch available
- Medium5.3Sensitive Information Disclosure via Directory Listing
Noo JobMonster
≤4.6.6Update to 4.6.6.1
- Medium5.3Unauthenticated Email Forgery
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<4.5.6Update to 4.5.6
- Critical9.8SQL Injection
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤7.11.17Update to 7.11.18
- Medium4.3Cross-Site Request Forgery Bypass
EWWW Image Optimizer
≤5.8.1Update to 5.9
- Medium5.5Constant Contact Forms <= 1.8.7 Editor+ Stored Cross-Site Scripting
Constant Contact Forms
<1.8.8Update to 1.8.8
- Medium4.3Cross-Site Request Forgery
ActiveCampaign – The autonomous marketing platform
<8.0.2Update to 8.0.2
- High7.2SQL injection
Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance
<3.0.2Update to 3.0.2
- Medium5.0Missing Authorization
NextScripts: Social Networks Auto-Poster
≤4.3.17Update to 4.3.18
- Critical9.8KEVPoCArbitrary File Upload/Remote Code Execution
File Manager
≤6.8Update to 6.9
- Medium5.4Cross-Site Scripting
Recall Products
≤0.8No patch available
- Medium5.4Stored Cross-Site Scripting
WP smart CRM & Invoices FREE
≤1.8.7No patch available
- Medium6.1Cross-Site Scripting
Chamber Dashboard Business Directory
<3.3.1Update to 3.3.1
- High8.8Authenticated SQL Injection
Recall Products
≤0.8No patch available
- Medium6.1Reflected Cross-Site Scripting
Subscribe Sidebar plugin by Blubrry
≤1.3.1No patch available
- High7.2SQL Injection
WordPress Poll
≤36No patch available