CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1321)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.5 | News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting | CVE-2017-18634 | — | |
| Critical9.8 | News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update | CVE-2016-10972 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-15043 | — | |
| Critical9.8 | SQL Injection | CVE-2016-15040 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2016-4812 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2017-9337 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10973 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10975 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10974 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10885 | — | |
| High8.1 | 2.9.42 - PHP Object Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder2.9.36 – 2.9.42Update to 2.9.42.1 | CVE-2016-1209 | — | |
| Medium6.5 | Directory Traversal | CVE-2016-10977 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10893 | — | |
| Critical9.8 | SQL Injection | CVE-2016-11018 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2015-10128 | — | |
| High7.2 | Cross-Site Scripting | CVE-2016-10976 | — | |
| Medium6.4 | Cross-Site Scripting via MediaElement.js WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2 | CVE-2016-4567 | — | |
| Medium6.1 | Cross-Site Scripting via plupload.flash.swf WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2 | CVE-2016-4566 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10994 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2016-15041 | — | |
| High7.5 | Missing Authorization Checks | CVE-2016-10983 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10920 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2016-10897 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-10995 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10985 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10987 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10986 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10984 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10870 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10982 | — |
- Medium6.5News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting
Newspaper - News & WooCommerce WordPress Theme
<6.7.2Update to 6.7.2
- Critical9.8News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update
Newspaper - News & WooCommerce WordPress Theme
≤6.7.1Update to 6.7.2
- Critical9.8Arbitrary File Upload
WP Mobile Detector
≤3.5Update to 3.6
- Critical9.8SQL Injection
Kento Post View Counter
≤2.8No patch available
- Medium6.1Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5Update to 2.5.1
- Medium6.1Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Brafton
<3.4.8Update to 3.4.8
- Medium6.1Reflected Cross-Site Scripting
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
- High8.8Cross-Site Request Forgery
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
- High8.8Cross-Site Request Forgery
WP Editor
<1.2.6Update to 1.2.6
- High8.12.9.42 - PHP Object Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
2.9.36 – 2.9.42Update to 2.9.42.1
- Medium6.5Directory Traversal
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤4.4.4Update to 4.5.0
- Medium6.1Cross-Site Scripting
Crayon Syntax Highlighter
<2.8.4Update to 2.8.4
- Critical9.8SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.8.9Update to 1.9.0
- Medium6.4Authenticated Stored Cross-Site Scripting
Royal PrettyPhoto
≤1.2Update to 1.3
- High7.2Cross-Site Scripting
Safe Editor
<1.2Update to 1.2
- Medium6.4Cross-Site Scripting via MediaElement.js
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
- Medium6.1Cross-Site Scripting via plupload.flash.swf
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
- Medium6.1Reflected Cross-Site Scripting
Truemag
all versionsNo patch available
- High7.2Stored Cross-Site Scripting
MainWP Dashboard: Self-hosted WordPress Management for Agencies
<3.1.3Update to 3.1.3
- High7.5Missing Authorization Checks
Ghost
≤0.5.5Update to 0.5.6
- Medium6.1Cross-Site Scripting
GNUCommerce
<0.5.7-betaUpdate to 0.5.7-beta
- Medium6.1Multiple Cross-Site Scripting
Sermon Browser
≤0.45.15Update to 0.45.16
- Critical9.8Arbitrary File Upload
Tevolution
<2.3.0Update to 2.3.0
- Medium6.1Reflected Cross-Site Scripting
Echo Sign
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
افزونه پیامک ووکامرس | Persian WooCommerce SMS
≤3.3.2Update to 3.3.3
- Medium6.1Reflected Cross-Site Scripting
Tweet Wheel
<1.0.3.3Update to 1.0.3.3
- Medium6.1Reflected Cross-Site Scripting
Echo Sign
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Translate WordPress – Google Language Translator
<5.0.06Update to 5.0.06
- High8.8Cross-Site Request Forgery
Kento Post View Counter
≤2.8No patch available