CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1322)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Stored Cross-Site Scripting
Kento Post View Counter
≤2.8No patch available
- High8.8Cross-Site Request Forgery
Kento Post View Counter
≤2.8No patch available
- Medium6.1Reflected Cross-Site Scripting
Kento Post View Counter
≤2.8No patch available
- High8.8Cross-Site Request Forgery
leenk.me
≤2.5.0Update to 2.6.0
- Medium6.4Cross-Site Scripting via Network Settings Page
WordPress
<4.5Update to 4.5
- Medium6.1Reflected Cross-Site Scripting
WPSOLR – Elasticsearch and Solr search
≤8.6Update to 8.7
- Medium6.1Reflected Cross-Site Scripting
S3 Video Plugin
≤0.983No patch available
- Medium6.1Reflected Cross-Site Scripting
MW Font Changer
<4.3Update to 4.3
- Medium6.1Reflected Cross-Site Scripting
Defa Online Image Protector Free Edition
≤3.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Hero Maps Pro
≤2.1.0Update to 2.2.0
- Medium6.1Reflected Cross-Site Scripting
MiniMax – Page Layout Builder
≤1.9.3No patch available
- High8.8Cross-Site Request Forgery
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤4.3Update to 4.3.1
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.3.40Update to 1.3.40
- Medium6.1Reflected Cross-Site Scripting
Post Duplicator
≤2.16Update to 2.17
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<4.0.7Update to 4.0.7
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Lightbox Plus
≤2.7.2No patch available
- Medium6.1Cross-Site Scripting
WP Customer Reviews
<3.0.9Update to 3.0.9
- High7.2Stored Cross-Site Scripting
WP Cerber Security, Anti-spam & Malware Scan
<2.7Update to 2.7
- Medium6.1Cross-Site Scripting
ScoreMe
≤2016-04-01No patch available
- High7.5Directory Traversal
Zedna eBook download
<1.2Update to 1.2
- Medium6.1Unauthenticated Cross-Site Scripting
WP Favorite Posts
≤1.6.5Update to 1.6.6
- Medium6.1Cross-Site Scripting
Music Store – WordPress eCommerce
≤1.0.41Update to 1.0.43
- High7.5Local File Inclusion
IMDB Profile Widget
<1.0.9Update to 1.0.9
- High8.1Unauthenticated Local File Inclusion
Issuu Panel
<1.6.6No patch available
- High7.5Arbitrary File Download
Memphis Documents Library
≤3.1.5Update to 3.1.6
- Critical9.8Local File Inclusion
A/B Test for WordPress
≤1.0.7No patch available
- High8.8Cross-Site Request Forgery via wp_ajax_wp_compression_test
WordPress
<4.5Update to 4.5
- High8.8Cross-Site Request Forgery & Arbitrary File Upload
Beauty & Clean
≤1.0.8No patch available
- Medium6.1Cross-Site Scripting
Ocim MP3
all versionsNo patch available
- Medium6.1Reflected Cross-Site Scripting
Shibboleth
≤1.6Update to 1.7