CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1314)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Cross-Site Request Forgery | CVE-2017-18544 | — | |
| High7.5 | Improper Input Validation | CVE-2017-18545 | — | |
| High7.5 | Email Injection | CVE-2017-18543 | — | |
| Critical9.8 | SQL Injection | CVE-2017-18571 | — | |
| High8.8 | SQL Injection | CVE-2017-1002010 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002009 | — | |
| Medium4.3 | Authorization Bypass | CVE-2017-6954 | — | |
| Medium5.3 | Change of Email Invitation Content | CVE-2017-6955 | — | |
| Critical9.8 | Arbitrary File Download | CVE-2017-1002008 | — | |
| High7.5 | Missing Authorization | CVE-2017-1002006 | — | |
| Critical9.8 | SQL Injection | CVE-2017-20247 | — | |
| High7.2 | SQL Injection via subscriber_email parameter | CVE-2017-6578 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002005 | — | |
| High7.5 | Authorization Bypass | CVE-2017-1002007 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002004 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-1002001 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-1002003 | — | |
| Medium6.1 | HTML Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.0.31Update to 3.0.31 | CVE-2017-18574 | — | |
| Medium6.4 | Authenticated Cross-Site Scripting in Youtube URL Embeds WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6817 | — | |
| Medium6.1 | Bypass URL Validation WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6815 | — | |
| Medium6.4 | Cross-Site Scripting via Media Metadata WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6814 | — | |
| High8.8 | Cross-Site Request Forgery via Press This WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6819 | — | |
| Medium6.4 | Cross-Site Scripting via Taxonomy names WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6818 | — | |
| Medium4.9 | Arbitrary File Deletion WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6816 | — | |
| High7.2 | SQL Injection via id parameter | CVE-2017-6576 | — | |
| High7.2 | SQL Injection via filter_list | CVE-2017-6574 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2017-6102 | — | |
| Critical9.8 | Security Bypass to Database Login | CVE-2017-20066 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2017-20055 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2017-18572 | — |
- High8.8Cross-Site Request Forgery
Invite Anyone
<1.3.16Update to 1.3.16
- High7.5Improper Input Validation
Invite Anyone
≤1.3.15Update to 1.3.16
- High7.5Email Injection
Invite Anyone
<1.3.16Update to 1.3.16
- Critical9.8SQL Injection
Search Everything
≤8.1.6Update to 8.1.7
- High8.8SQL Injection
Membership Simplified
<1.58Update to 1.58
- Critical9.8SQL Injection
Membership Simplified
≤1.58No patch available
- Medium4.3Authorization Bypass
BuddyPress Docs
<1.9.3Update to 1.9.3
- Medium5.3Change of Email Invitation Content
Invite Anyone
<1.3.15Update to 1.3.15
- Critical9.8Arbitrary File Download
Membership Simplified
≤1.58No patch available
- High7.5Missing Authorization
DTracker
≤1.5No patch available
- Critical9.8SQL Injection
PICA Photo Gallery
≤1.0No patch available
- High7.2SQL Injection via subscriber_email parameter
Mail Masta
≤1.0No patch available
- Critical9.8SQL Injection
DTracker
≤1.5No patch available
- High7.5Authorization Bypass
DTracker
≤1.5No patch available
- Critical9.8SQL Injection
DTracker
≤1.5No patch available
- Critical9.8Arbitrary File Upload
Mobile App Builder by WapPress
≤1.05No patch available
- Critical9.8Arbitrary File Upload
Wp2android
≤1.1.4No patch available
- Medium6.1HTML Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.0.31Update to 3.0.31
- Medium6.4Authenticated Cross-Site Scripting in Youtube URL Embeds
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.1Bypass URL Validation
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Cross-Site Scripting via Media Metadata
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- High8.8Cross-Site Request Forgery via Press This
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Cross-Site Scripting via Taxonomy names
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium4.9Arbitrary File Deletion
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- High7.2SQL Injection via id parameter
Mail Masta
≤1.0No patch available
- High7.2SQL Injection via filter_list
Mail Masta
≤1.0No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
wordpress plugin rockhoist-badges
≤1.2.2No patch available
- Critical9.8Security Bypass to Database Login
adminer
≤1.4.5No patch available
- Medium6.4Stored Cross-Site Scripting
Contact Form Plugin
≤4.0.1Update to 4.0.2
- High7.2Stored Cross-Site Scripting
GNUCommerce
<1.4.2Update to 1.4.2