CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1325)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Cross-Site Scripting via p_name parameter
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
- High8.8Authenticated Command Injection
Cool Video Gallery
<2.0Update to 2.0
- Medium6.1Cross-Site Scripting
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
- Medium6.1Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.3.29Update to 1.3.29
- High8.8Authenticated Blind SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.64Update to 1.5.64
- Critical9.8SQL Injection
Google Doc Embedder
<2.5.17Update to 2.5.17
- Medium6.1Reflected Cross-Site Scripting
Auto Thickbox Plus
≤1.9No patch available
- Critical9.8SQL Injection
Double Opt-In for Download
<2.0.9Update to 2.0.9
- High7.2Authenticated SQL Injection
WP-Stats-Dashboard
≤2.9.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Websimon Tables
≤1.3.4No patch available
- High7.2Authenticated (Admin+) SQL Injection
Watu Quiz
≤2.6.7Update to 2.6.8
- High8.8Arbitrary File Upload
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.59Update to 1.5.59
- Critical9.8SQL Injection
WP Fastest Cache – WordPress Cache Plugin
<0.8.4.9Update to 0.8.4.9
- Medium6.1Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<2.2.5Update to 2.2.5
- High8.8Cross-Site Request Forgery
Tag Miner (Automatic Tag Extraction)
<1.1.5Update to 1.1.5
- Medium6.1Cross-Site Scripting
Tag Miner (Automatic Tag Extraction)
<1.1.5Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll
≤2.0No patch available
- Critical9.0Remote File Inclusion
Gwolle Guestbook
<1.5.4Update to 1.5.4
- Medium6.1Cross-Site Scripting
WordPress Calls to Action
<2.5.1Update to 2.5.1
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.4.1Update to 3.4.1
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Crony Cronjob Manager
<0.4.7Update to 0.4.7
- Critical9.8SQL Injection
Visitors Online by BestWebSoft
≤0.3Update to 0.4
- High8.8SQL Injection
wp-championship
<5.9Update to 5.9
- High8.8Authenticated SQL Injection
Dynamic Widgets
≤1.5.10Update to 1.5.11
- Medium6.1Cross-Site Scripting
Akismet Anti-spam: Spam Protection
<3.1.5Update to 3.1.5
- Medium6.1Cross-Site Scripting
Connect Matomo – Analytics Dashboard for WordPress
<1.0.5Update to 1.0.5
- Medium4.9Path Traversal
Font – official webfonts plugin of Fonts For Web. NO CODING! Just click & change font size, color and font face visually!
≤7.5Update to 7.5.1
- Medium6.1Reflected Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
<2.0.19Update to 2.0.19
- Medium6.3Authenticated SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
<2.0.19Update to 2.0.19