CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1318)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Cross-Site Request Forgery | CVE-2016-10903 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000151 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000145 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000132 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000149 | — | |
| Medium6.1 | Reflected Cross-Site Scripting via channel parameter | CVE-2016-1000135 | — | |
| Medium6.1 | Reflected Cross-Site Scripting via playlist parameter | CVE-2016-1000134 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000153 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000131 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000154 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000138 | — | |
| Medium6.1 | Reflected Cross-Site Scripting via gid | CVE-2016-1000143 | — | |
| Critical9.8 | SQL Injection | CVE-2016-1000217 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10877 | — | |
| Medium5.0 | Server-Side Request Forgery | CVE-2016-4029 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10882 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10881 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10880 | — | |
| High7.5 | Insecure Direct Object Reference | CVE-2016-10930 | — | |
| Critical9.8 | Multipurpose WordPress Theme | WordPress < 1.8 - Arbitrary File Upload | CVE-2016-10954 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2016-10941 | — | |
| High8.8 | Multiple Cross-Site Request Forgery | CVE-2016-10884 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2019-15110 | — | |
| Critical9.8 | Privilege Escalation | CVE-2019-15111 | — | |
| Medium6.5 | Authenticated Directory Traversal to Arbitrary File Access WordPress≤4.6Update to 3.7.16 or 3.8.16 or 3.9.14 or 4.0.13 or 4.1.13 or 4.2.10 or 4.3.6 or 4.4.5 or 4.5.4 or 4.6.1 | CVE-2016-7169 | — | |
| Medium4.8 | Authenticated Stored Cross-Site Scripting WordPress≤4.6Update to 3.7.16 or 3.8.16 or 3.9.14 or 4.0.13 or 4.1.13 or 4.2.10 or 4.3.6 or 4.4.5 or 4.5.4 or 4.6.1 | CVE-2016-7168 | — | |
| High8.8 | Cross-Site Request Forgery CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation<1.7.9Update to 1.7.9 | CVE-2016-10915 | 9K+ | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000139 | — | |
| Critical9.8 | Arbitrary File Upload/Read | CVE-2016-10955 | — | |
| Critical9.8 | Local File Inclusion | CVE-2016-10956 | — |
- High8.8Cross-Site Request Forgery
GoDaddy Email Marketing
<1.1.4Update to 1.1.4
- Medium6.1Reflected Cross-Site Scripting
Tera Charts
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Pondol Carousel
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
CM Tooltip Glossary
<3.3.5Update to 3.3.5
- Medium6.1Reflected Cross-Site Scripting
Simpel Reserveren 3
≤3.5.2No patch available
- Medium6.1Reflected Cross-Site Scripting via channel parameter
HDW WordPress Video Gallery
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting via playlist parameter
HDW WordPress Video Gallery
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Tidio Gallery
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
E-Search
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
WHIZZ
<1.0.8Update to 1.0.8
- Medium6.1Reflected Cross-Site Scripting
indexisto
≤1.0.5No patch available
- Medium6.1Reflected Cross-Site Scripting via gid
PhotoXhibit
≤2.1.8No patch available
- Critical9.8SQL Injection
Zotpress
<6.1.3Update to 6.1.3
- Medium6.1Cross-Site Scripting
WP Editor
<1.2.6.3Update to 1.2.6.3
- Medium5.0Server-Side Request Forgery
WordPress
<4.5Update to 4.5
- High8.8Cross-Site Request Forgery
Google Doc Embedder
≤2.6.1Update to 2.6.2
- Medium6.1Cross-Site Scripting
Google Doc Embedder
<2.6.2Update to 2.6.2
- Medium6.1Cross-Site Scripting
Google Doc Embedder
<2.6.1Update to 2.6.1
- High7.5Insecure Direct Object Reference
WP Support Plus Responsive Ticket System
<7.1.0Update to 7.1.0
- Critical9.8Multipurpose WordPress Theme | WordPress < 1.8 - Arbitrary File Upload
Neosense - Multipurpose WordPress Theme | WordPress
<1.8Update to 1.8
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Podlove Podcast Publisher
<2.3.16Update to 2.3.16
- High8.8Multiple Cross-Site Request Forgery
Simple Membership
≤3.3.2Update to 3.3.3
- Medium6.4Stored Cross-Site Scripting
WP Frontend Profile
≤0.2.1Update to 0.2.2
- Critical9.8Privilege Escalation
WP Frontend Profile
≤0.2.1Update to 0.2.2
- Medium6.5Authenticated Directory Traversal to Arbitrary File Access
WordPress
≤4.6Update to 3.7.16 or 3.8.16 or 3.9.14 or 4.0.13 or 4.1.13 or 4.2.10 or 4.3.6 or 4.4.5 or 4.5.4 or 4.6.1
- Medium4.8Authenticated Stored Cross-Site Scripting
WordPress
≤4.6Update to 3.7.16 or 3.8.16 or 3.9.14 or 4.0.13 or 4.1.13 or 4.2.10 or 4.3.6 or 4.4.5 or 4.5.4 or 4.6.1
- High8.8Cross-Site Request Forgery
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
<1.7.9Update to 1.7.9
- Medium6.1Reflected Cross-Site Scripting
Infusionsoft Gravity Forms Add-on
<1.5.12Update to 1.5.12
- Critical9.8Arbitrary File Upload/Read
CYSTEME Finder, the admin files explorer
<1.4Update to 1.4
- Critical9.8Local File Inclusion
Mail Masta
≤1.0No patch available