CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1324)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
- High8.8Privilege Escalation
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
- Medium5.3Missing Authorization
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
- Medium5.3Insecure Direct Object Reference
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
- Medium5.3Missing Authorization
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
- High8.8Cross-Site Request Forgery
Simple add pages or posts
<1.7Update to 1.7
- Medium5.4Open Redirect via wp_validate_redirect
WordPress
≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2
- Medium6.1Multiple Cross-Site Scripting
eShop
≤6.3.14No patch available
- Medium6.4Server-Side Request Forgery
WordPress
≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2
- High8.8Multiple SQL Injections
eShop
≤6.3.14No patch available
- Medium6.1Cross-Site Scripting
Connections Business Directory
<8.5.9Update to 8.5.9
- Medium6.4Cross-Site Scripting
Sola Support Tickets
<3.13Update to 3.13
- Medium6.1Reflected Cross-Site Scripting
IMPress Listings
≤2.0.1Update to 2.0.2
- High8.8SQL Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤1.07.11Update to 2.0
- Critical9.8SQL Injection
Appointment Booking Calendar
<1.1.24Update to 1.1.24
- High7.5Authentication Bypass
OneLogin SAML SSO
<2.2.0Update to 2.2.0
- Medium5.5Cross-Site Scripting via Theme Names
WordPress
≤4.4Update to 3.7.12 or 3.8.12 or 3.9.10 or 4.0.9 or 4.1.9 or 4.2.6 or 4.3.2 or 4.4.1
- Medium5.3Remote Code Execution
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
<1.1.4.6Update to 1.1.4.6
- High8.8Unrestricted File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.10Update to 2.1.15
- Medium6.1Reflected Cross-Site Scripting
mTouch Quiz
≤3.1.2Update to 3.1.3
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
mTouch Quiz
<3.1.3Update to 3.1.3
- Medium6.4Stored Cross-Site Scripting
mTouch Quiz
≤3.1.2Update to 3.1.3
- Medium6.5Cross-Site Request Forgery
mTouch Quiz
<3.1.3Update to 3.1.3
- High8.8SQL Injection
Welcart e-Commerce
<1.5.3Update to 1.5.3
- Medium4.3Missing Authorization Checks
Admin Management Xtended
≤2.4.0Update to 2.4.0.1
- Critical9.8SQL Injection
Smart External Link Click Monitor [Link Log]
<2.1Update to 2.1
- Medium6.1Cross-Site Scripting
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.2No patch available
- Medium6.4Cross-Site Scripting
Content text slider on post
<6.9Update to 6.9
- Medium6.1Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.3.29Update to 1.3.29
- Medium6.1Reflected Cross-Site Scripting
Role Scoper (Obsolete – Please install PublishPress Permissions)
<1.3.67Update to 1.3.67