CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1320)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.8 | CSV Injection | CVE-2016-10762 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10911 | — | |
| Critical9.8 | SQL Injection | CVE-2016-10921 | — | |
| Medium4.3 | Authenticated Information Disclosure | CVE-2018-20154 | — | |
| Medium5.4 | Missing Authorization | CVE-2018-20155 | — | |
| Critical9.1 | Directory Traversal | CVE-2016-10965 | — | |
| High7.5 | File Upload to User Controlled Location | CVE-2016-10966 | — | |
| High7.5 | Arbitrary File Upload | CVE-2016-10929 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10967 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10961 | — | |
| Medium6.1 | Cross-Site Scripting via a ticket excerpt. | CVE-2016-10970 | — | |
| Critical9.8 | Authentication Bypass | CVE-2016-10971 | — | |
| High8.1 | Object Injection | CVE-2016-4825 | — | |
| Critical9.8 | Authentication Bypass | CVE-2016-4828 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-4827 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-4826 | — | |
| Critical9.8 | Remote File Upload | CVE-2016-1000112 | — | |
| High8.8 | Privilege Escalation | CVE-2016-10968 | — | |
| High7.2 | Stored Cross-Site Scripting via discussion ticket title | CVE-2016-10969 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10705 | — | |
| High7.3 | Bypass sanitize_file_name Protection WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5839 | — | |
| Medium6.4 | Cross-Site Scripting via Attachment Name WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5834 | — | |
| Medium4.3 | Revision History Disclosure WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5835 | — | |
| Medium5.5 | Cross-Site Scripting via Customizer WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5832 | — | |
| Medium5.3 | Denial of Service via oEmbed Protocol WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5836 | — | |
| Medium6.4 | Cross-Site Scripting via Attachment Name #2 WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5833 | — | |
| Medium5.4 | Authorization Bypass to Remove Category Attribute WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5837 | — | |
| Medium5.3 | Password Change via Stolen Cookie WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5838 | — | |
| Critical9.8 | SQL Injection | CVE-2016-10917 | — | |
| Critical9.6 | Remote Code Execution | CVE-2016-20010 | — |
- Medium5.8CSV Injection
CampTix Event Ticketing
<1.5Update to 1.5
- Medium6.1Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<2.4.2Update to 2.4.2
- Critical9.8SQL Injection
Photo Gallery by Ays – Responsive Image Gallery
<1.0.1Update to 1.0.1
- Medium4.3Authenticated Information Disclosure
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Medium5.4Missing Authorization
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Critical9.1Directory Traversal
Real3D Flipbook
≤1.0.0No patch available
- High7.5File Upload to User Controlled Location
Real3D Flipbook
≤1.0.0No patch available
- High7.5Arbitrary File Upload
Advanced AJAX Page Loader
<2.7.7Update to 2.7.7
- Medium6.1Reflected Cross-Site Scripting
Real3D Flipbook
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
ColorWay
≤3.4.1Update to 3.4.2
- Medium6.1Cross-Site Scripting via a ticket excerpt.
SupportFlow
<0.7Update to 0.7
- Critical9.8Authentication Bypass
MemberSonic Lite Membership Site Plugin
≤1.2Update to 1.302
- High8.1Object Injection
Welcart e-Commerce
<1.8.3Update to 1.8.3
- Critical9.8Authentication Bypass
Welcart e-Commerce
≤1.8.2Update to 1.8.3
- Medium6.1Cross-Site Scripting
Welcart e-Commerce
≤1.8.2Update to 1.8.3
- Medium6.1Reflected Cross-Site Scripting
Welcart e-Commerce
<1.8.3Update to 1.8.3
- Critical9.8Remote File Upload
contus-video-comments
≤1.0No patch available
- High8.8Privilege Escalation
Community by PeepSo – Download from PeepSo.com
≤1.6.0Update to 1.6.1
- High7.2Stored Cross-Site Scripting via discussion ticket title
SupportFlow
≤0.6Update to 0.7
- Medium6.1Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<4.0.4Update to 4.0.4
- High7.3Bypass sanitize_file_name Protection
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium6.4Cross-Site Scripting via Attachment Name
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium4.3Revision History Disclosure
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.5Cross-Site Scripting via Customizer
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.3Denial of Service via oEmbed Protocol
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium6.4Cross-Site Scripting via Attachment Name #2
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.4Authorization Bypass to Remove Category Attribute
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.3Password Change via Stolen Cookie
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Critical9.8SQL Injection
Search Everything
<8.1.6Update to 8.1.6
- Critical9.6Remote Code Execution
EWWW Image Optimizer
≤2.8.4Update to 2.8.5