CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1307)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Emag Marketplace Connector
<1.0.1Update to 1.0.1
- Medium5.4Cross-Site Scripting
amtyThumb posts
≤8.2.0No patch available
- High8.8Authenticated PHP Object Injection
WooCommerce
<3.2.4Update to 3.2.4
- Medium6.4Stored Cross-Site Scripting
Affiliate Ads for Clickbank Products
≤1.6Update to 1.7
- High8.3Unauthenticated Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<2.05.03Update to 2.05.03
- Medium5.3Unauthenticated Information Disclosure
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<2.05.03Update to 2.05.03
- Critical9.8Authentication Bypass
UserPro - Community and User Profile WordPress Plugin
<4.9.17.1Update to 4.9.17.1
- Medium6.1Cross-Site Scripting
Simple Membership
<3.5.7Update to 3.5.7
- Medium6.1Reflected Cross-Site Scripting
Ultimate Instagram Feed – WordPress Plugin
<1.3Update to 1.3
- Medium6.1Duplicator <= 1.2.28 – Unauthenticated Stored Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.2.28Update to 1.2.30
- Medium6.1Cross-Site Scripting
Content Cards
≤0.9.6Update to 0.9.7
- Medium6.1Cross-Site Scripting
Football Pool
<2.6.5Update to 2.6.5
- High8.8SQL Injection
JTRT Responsive Tables
<4.1.2Update to 4.1.2
- Critical9.8SQL Injection due to Double Prepare approach
WordPress
≤4.8.2Update to 3.7.23 or 3.8.23 or 3.9.21 or 4.0.20 or 4.1.20 or 4.2.17 or 4.3.13 or 4.4.12 or 4.5.11 or 4.6.8 or 4.7.7 or 4.8.3
- High8.8Authenticated Remote Code Execution
Shortcodes Ultimate – Content Elements
<5.0.1Update to 5.0.1
- Medium6.1Cross-Site Scripting
User Login History
<1.6Update to 1.6
- Critical9.8SQL Injection to PHP Object Injection
Contact Form for WordPress – Ultimate Form Builder Lite
<1.3.7Update to 1.3.7
- Medium6.1Cross-Site Scripting
Easy Appointments
<1.12.0Update to 1.12.0
- Medium6.1Reflected Cross-Site Scripting
External Media without Import
<1.0.0Update to 1.0.0
- Medium6.1Reflected Cross-Site Scripting
PopCash Code Integration Tool
<1.1Update to 1.1
- Medium5.4Reflected Cross-Site Scripting
pootle button
≤1.1.1Update to 1.2.0
- Medium6.1Authenticated Cross-Site Scripting
Max Mega Menu
≤2.3.8Update to 2.4
- High7.2Stored Cross-Site Scripting
Quards
all versionsNo patch available
- Medium4.7Cross-domain Flash injection
WordPress
≤4.9.1Update to 3.7.25 or 3.8.25 or 3.9.24 or 4.0.22 or 4.1.22 or 4.2.19 or 4.3.15 or 4.4.14 or 4.5.13 or 4.6.10 or 4.7.9 or 4.8.5 or 4.9.2
- Medium5.3All Known Versions - Cleartext Storage of wp_signups.activation_key
WordPress
all versionsNo patch available
- Critical9.8SQL Injection
Simple Login Log
<1.1.2Update to 1.1.2
- Medium6.1Reflected Cross-Site Scripting
My WP Translate
≤1.0.3Update to 1.0.4
- Critical9.8SQL Injection
Simple Login Log
<1.1.2Update to 1.1.2
- High8.0Unprotected AJAX Actions
My WP Translate
<1.0.4Update to 1.0.4
- Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.4.6Update to 3.4.6