CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1299)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting via wpFastestCachePage options, wpFastestCachePreload_number or wpFastestCacheLanguage parameter | CVE-2018-17585 | — | |
| Medium6.1 | Cross-Site Scripting via the rules[0][content] parameter in a wpfc_save_exclude_pages action | CVE-2018-17583 | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2018-18069 | — | |
| Medium6.1 | Multiple Cross-Site Scripting vulnerabilities | CVE-2018-17866 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-18017 | — | |
| High7.2 | SQL Injection | CVE-2018-18018 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-18019 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20972 | — | |
| Critical9.8 | Local File Inclusion | CVE-2018-20973 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2018-17573 | — | |
| High7.5 | Firewall Bypass | CVE-2019-17214 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-17213 | — | |
| Critical9.8 | Directory Traversal | CVE-2018-16283 | — | |
| High7.5 | Directory Traversal | CVE-2018-16299 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002007 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002002 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002009 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002004 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002003 | — | |
| High7.2 | SQL Injection | CVE-2018-1002000 | — | |
| Medium4.8 | Cross-Site Scripting | CVE-2018-1002006 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002008 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002001 | — | |
| Medium4.8 | Cross-Site Scripting | CVE-2018-1002005 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2018-16967 | 1M+ | |
| Critical9.8 | Unauthenticated Arbitrary File Upload/Download | CVE-2018-25105 | 1M+ | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-16966 | 1M+ | |
| High7.5 | PHAR Unserialization WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-1000773 | — | |
| Critical9.8 | Privilege Escalation | CVE-2018-16613 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-16363 | 1M+ |
- Medium6.1Cross-Site Scripting via wpFastestCachePage options, wpFastestCachePreload_number or wpFastestCacheLanguage parameter
WP Fastest Cache – WordPress Cache Plugin
≤0.8.8.5Update to 0.8.8.6
- Medium6.1Cross-Site Scripting via the rules[0][content] parameter in a wpfc_save_exclude_pages action
WP Fastest Cache – WordPress Cache Plugin
≤0.8.8.5Update to 0.8.8.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WPML Multilingual CMS
≤3.6.3Update to 4.0
- Medium6.1Multiple Cross-Site Scripting vulnerabilities
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.27Update to 2.0.28
- Medium6.1Cross-Site Scripting
Slideshow Gallery LITE
≤1.6.8Update to 1.6.9
- High7.2SQL Injection
Slideshow Gallery LITE
≤1.6.8Update to 1.6.9
- Medium6.1Cross-Site Scripting
Slideshow Gallery LITE
≤1.6.8Update to 1.6.9
- High8.8Cross-Site Request Forgery
Companion Auto Update
<3.2.1Update to 3.2.1
- Critical9.8Local File Inclusion
Companion Auto Update
<3.2.1Update to 3.2.1
- Critical9.8Arbitrary File Upload
Wp-Insert
≤2.4.2Update to 2.4.3
- High7.5Firewall Bypass
WebARX
≤1.3.0No patch available
- Medium6.1Stored Cross-Site Scripting
WebARX
≤1.3.0No patch available
- Critical9.8Directory Traversal
微信群发助手-Wechat Broadcast
≤1.2.0No patch available
- High7.5Directory Traversal
Localize My Post
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- High7.2SQL Injection
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium4.8Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium4.8Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Stored Cross-Site Scripting
File Manager
≤3.0Update to 3.1
- Critical9.8Unauthenticated Arbitrary File Upload/Download
File Manager
≤3.0Update to 3.1
- High8.8Cross-Site Request Forgery
File Manager
≤3.0Update to 3.1
- High7.5PHAR Unserialization
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Critical9.8Privilege Escalation
wpForo Forum
≤1.5.1Update to 1.5.2
- Medium6.1Reflected Cross-Site Scripting
File Manager
<3.0Update to 3.0