CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1331)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Directory Traversal | CVE-2015-5471 | — | |
| High7.2 | Blind SQL Injection | CVE-2015-9462 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5528 | — | |
| High7.5 | Arbitrary File Download | CVE-2015-9463 | — | |
| High7.2 | Blind SQL Injection | CVE-2015-9461 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9313 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9312 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2015-3299 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9460 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2015-9479 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9465 | — | |
| High7.5 | Directory Traversal | CVE-2015-5468 | — | |
| Medium6.1 | Open Redirect | CVE-2015-5461 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9466 | — | |
| High7.5 | Directory Traversal to Arbitrary File Access | CVE-2015-9464 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9467 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9468 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-9340 | — | |
| High7.5 | Directory Traversal | CVE-2015-5469 | — | |
| Critical9.1 | Path Traversal | CVE-2015-5609 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-5681 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-5682 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2015-9314 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5057 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9342 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2015-9343 | — | |
| Critical9.8 | SQL Injection | CVE-2015-5599 | — | |
| High7.5 | Directory Traversal | CVE-2015-4704 | — | |
| High8.8 | Arbitrary Options Update | CVE-2015-9475 | — | |
| High8.8 | Fullscreen Photography Theme | Portfolio <= 1.8.5 - Arbitrary Options Update | CVE-2015-9476 | — |
- Medium5.3Directory Traversal
Swim Team
≤1.44.1077Update to 1.45.1085
- High7.2Blind SQL Injection
Awesome Filterable Portfolio
<1.9Update to 1.9
- Medium6.1Cross-Site Scripting
Floating Social Bar
<1.1.7Update to 1.1.7
- High7.5Arbitrary File Download
S3Bubble Cloud Video with Adverts and Analytics
<4.8Update to 4.8
- High7.2Blind SQL Injection
Awesome Filterable Portfolio
<1.9Update to 1.9
- Critical9.8SQL Injection
NewStatPress
<1.0.6Update to 1.0.6
- Medium6.1Reflected Cross-Site Scripting
NewStatPress
<1.0.6Update to 1.0.6
- Medium6.1Unauthenticated Cross-Site Scripting
Floating Social Bar
≤1.1.6Update to 1.1.7
- High8.8Authenticated SQL Injection
Pinpoint Booking System – Legacy version
<2.1Update to 2.1
- Critical9.8Unauthenticated Arbitrary File Upload
acf-frontend-display
≤2.0.6No patch available
- High8.8Authenticated SQL Injection
YASR – Yet Another Star Rating Plugin for WordPress
<0.9.1Update to 0.9.1
- High7.5Directory Traversal
WP eCommerce Shop Styling
<2.6Update to 2.6
- Medium6.1Open Redirect
StageShow
<5.0.9Update to 5.0.9
- Critical9.8SQL Injection
WTI Like Post
<1.4.3Update to 1.4.3
- High7.5Directory Traversal to Arbitrary File Access
S3 Bubble Amazon S3 HTML5 Video with Adverts
≤0.7Update to 0.8
- Critical9.8SQL Injection
Broken Link Manager
<0.5.0Update to 0.5.0
- Medium6.1Cross-Site Scripting
Broken Link Manager
≤0.4.5Update to 0.5.0
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.0.0Update to 3.0.0
- High7.5Directory Traversal
MDC YouTube Downloader
<2.1.1Update to 2.1.1
- Critical9.1Path Traversal
Image Export
≤1.1Update to 1.1.1
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available
- High7.2Stored Cross-Site Scripting
NewStatPress
≤1.0.3Update to 1.0.4
- Medium6.1Cross-Site Scripting
Broken Link Checker
<1.10.9Update to 1.10.9
- Medium6.1Cross-Site Scripting
WP Rollback – Rollback Plugins and Themes
<1.2.3Update to 1.2.3
- High8.8Cross-Site Request Forgery
WP Rollback – Rollback Plugins and Themes
<1.2.3Update to 1.2.3
- Critical9.8SQL Injection
Powerplay Gallery
≤3.3No patch available
- High7.5Directory Traversal
download-zip-attachments
≤1.0No patch available
- High8.8Arbitrary Options Update
Pont - Multipurpose Wordpress Theme | Business
≤1.5No patch available
- High8.8Fullscreen Photography Theme | Portfolio <= 1.8.5 - Arbitrary Options Update
Teardrop - Fullscreen Photography Theme | Portfolio
≤1.8.5Update to 1.8.6