CWE-200Vulnerability type

WordPress Information Exposure vulnerabilities (page 1335)

Debug logs, backups and exports left reachable without authentication.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Information Exposure vulnerabilities (page 1335)
Severity	Vulnerability	CVE	Installs	Published
Medium4.3	Cross-Site Request Forgery WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export≤3.7.2Update to 3.7.3	CVE-2015-10125	—	May 5, 2015
Medium6.1	Cross-Site Scripting WeeklyNews<2.2.9Update to 2.2.9	CVE-2015-9504	—	May 3, 2015
High7.5	2.2.21 - Information Exposure Slideshow2.2.8 – 2.2.21Update to 2.2.22	CVE-2015-3634	—	May 2, 2015
High8.8	Cross-Site Request Forgery to Cross-Site Scripting Ad Inserter – Ad Manager & AdSense Ads<1.5.3Update to 1.5.3	CVE-2015-9497	—	May 2, 2015
Medium6.1	Reflected Cross-Site Scripting GF Windcave Free≤1.4.2Update to 1.4.3	CVE-2015-10117	—	May 1, 2015
Medium4.9	Directory Traversal TheCartPress eCommerce Shopping Cart≤1.5.3.6No patch available	CVE-2015-3301	—	Apr 29, 2015
High7.5	Sensitive Information Disclosure TheCartPress eCommerce Shopping Cart≤1.5.3.6No patch available	CVE-2015-3302	—	Apr 29, 2015
Medium6.1	Multiple Cross-Site Scripting TheCartPress eCommerce Shopping Cart≤1.5.3.6No patch available	CVE-2015-3300	—	Apr 29, 2015
High7.5	HTTP Response Splitting Smart External Link Click Monitor [Link Log]≤1.4Update to 2.0	CVE-2015-9345	—	Apr 28, 2015
Medium6.1	Ultimate Newspaper Theme <= 1.3.3 - Cross-Site Scripting Exquisite - Ultimate Newspaper Theme≤1.3.3No patch available	CVE-2015-9500	—	Apr 28, 2015
High7.2	Cross-Site Scripting via Comments WordPress≤4.2Update to 4.0.4 or 4.1.4 or 4.2.1	CVE-2015-3440	—	Apr 27, 2015
High8.8	Cross-Site Request Forgery WPS Hide Login<1.1Update to 1.1	CVE-2015-9498	—	Apr 27, 2015
Medium6.1	Reflected Cross-Site Scripting Resend Welcome Email≤1.0.1Update to 1.0.2	CVE-2015-10078	—	Apr 27, 2015
Medium6.1	Reflected Cross-Site Scripting WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<2.3.7Update to 2.3.7	CVE-2015-9305	—	Apr 24, 2015
Medium6.1	Reflected Cross-Site Scripting Mark User as Spammer≤1.0.1Update to 1.0.2	CVE-2015-10093	—	Apr 22, 2015
Medium6.1	Reflected Cross-Site Scripting WooFramework Branding≤1.0.1Update to 1.0.2	CVE-2015-10112	—	Apr 22, 2015
Medium6.1	Cross-Site Scripting OptionTree≤2.5.3Update to 2.5.4	CVE-2015-9320	—	Apr 22, 2015
Medium6.1	Reflected Cross-Site Scripting Icons for Features≤1.0.0Update to 1.0.1	CVE-2015-10104	—	Apr 22, 2015
Medium6.1	Reflected Cross-Site Scripting WooSidebars Sidebar Manager Converter≤1.1.1Update to 1.1.2	CVE-2015-10115	—	Apr 22, 2015
Medium6.1	Reflected Cross-Site Scripting WooFramework Tweaks≤1.0.1Update to 1.0.2	CVE-2015-10113	—	Apr 22, 2015
Medium6.1	Reflected Cross-Site Scripting WooSidebars≤1.4.1Update to 1.4.2	CVE-2015-10114	—	Apr 22, 2015
High7.1	Cross-Site Scripting WP-Spreadplugin<3.8.6.2Update to 3.8.6.2	CVE-2015-10132	—	Apr 21, 2015
High7.2	Cross-Site Scripting WordPress≤4.1.1Update to 3.7.6 or 3.8.6 or 3.9.4 or 4.0.2 or 4.1.2	CVE-2015-3438	—	Apr 21, 2015
Medium6.1	Reflected Cross-Site Scripting Shortcode Factory≤1.1Update to 1.1.1	CVE-2015-9321	—	Apr 21, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7	CVE-2015-9505	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – Manual Purchases<1.9.1Update to 1.9.1	CVE-2015-9517	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – Content Restriction≤2.0.7Update to 2.0.8	CVE-2015-9509	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – Pushover notifications≤1.2.8Update to 1.2.9	CVE-2015-9521	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy US Sales Taxes Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9369	—	Apr 20, 2015
Medium6.1	Quota < 1.2.5 - Cross-Site Scripting Easy Digital Downloads - Quota<1.2.5Update to 1.2.5	CVE-2015-9534	—	Apr 20, 2015

Medium4.3
Cross-Site Request Forgery
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤3.7.2Update to 3.7.3
CVE-2015-10125May 5, 2015
Medium6.1
Cross-Site Scripting
WeeklyNews
<2.2.9Update to 2.2.9
CVE-2015-9504May 3, 2015
High7.5
2.2.21 - Information Exposure
Slideshow
2.2.8 – 2.2.21Update to 2.2.22
CVE-2015-3634May 2, 2015
High8.8
Cross-Site Request Forgery to Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
<1.5.3Update to 1.5.3
CVE-2015-9497May 2, 2015
Medium6.1
Reflected Cross-Site Scripting
GF Windcave Free
≤1.4.2Update to 1.4.3
CVE-2015-10117May 1, 2015
Medium4.9
Directory Traversal
TheCartPress eCommerce Shopping Cart
≤1.5.3.6No patch available
CVE-2015-3301Apr 29, 2015
High7.5
Sensitive Information Disclosure
TheCartPress eCommerce Shopping Cart
≤1.5.3.6No patch available
CVE-2015-3302Apr 29, 2015
Medium6.1
Multiple Cross-Site Scripting
TheCartPress eCommerce Shopping Cart
≤1.5.3.6No patch available
CVE-2015-3300Apr 29, 2015
High7.5
HTTP Response Splitting
Smart External Link Click Monitor [Link Log]
≤1.4Update to 2.0
CVE-2015-9345Apr 28, 2015
Medium6.1
Ultimate Newspaper Theme <= 1.3.3 - Cross-Site Scripting
Exquisite - Ultimate Newspaper Theme
≤1.3.3No patch available
CVE-2015-9500Apr 28, 2015
High7.2
Cross-Site Scripting via Comments
WordPress
≤4.2Update to 4.0.4 or 4.1.4 or 4.2.1
CVE-2015-3440Apr 27, 2015
High8.8
Cross-Site Request Forgery
WPS Hide Login
<1.1Update to 1.1
CVE-2015-9498Apr 27, 2015
Medium6.1
Reflected Cross-Site Scripting
Resend Welcome Email
≤1.0.1Update to 1.0.2
CVE-2015-10078Apr 27, 2015
Medium6.1
Reflected Cross-Site Scripting
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<2.3.7Update to 2.3.7
CVE-2015-9305Apr 24, 2015
Medium6.1
Reflected Cross-Site Scripting
Mark User as Spammer
≤1.0.1Update to 1.0.2
CVE-2015-10093Apr 22, 2015
Medium6.1
Reflected Cross-Site Scripting
WooFramework Branding
≤1.0.1Update to 1.0.2
CVE-2015-10112Apr 22, 2015
Medium6.1
Cross-Site Scripting
OptionTree
≤2.5.3Update to 2.5.4
CVE-2015-9320Apr 22, 2015
Medium6.1
Reflected Cross-Site Scripting
Icons for Features
≤1.0.0Update to 1.0.1
CVE-2015-10104Apr 22, 2015
Medium6.1
Reflected Cross-Site Scripting
WooSidebars Sidebar Manager Converter
≤1.1.1Update to 1.1.2
CVE-2015-10115Apr 22, 2015
Medium6.1
Reflected Cross-Site Scripting
WooFramework Tweaks
≤1.0.1Update to 1.0.2
CVE-2015-10113Apr 22, 2015
Medium6.1
Reflected Cross-Site Scripting
WooSidebars
≤1.4.1Update to 1.4.2
CVE-2015-10114Apr 22, 2015
High7.1
Cross-Site Scripting
WP-Spreadplugin
<3.8.6.2Update to 3.8.6.2
CVE-2015-10132Apr 21, 2015
High7.2
Cross-Site Scripting
WordPress
≤4.1.1Update to 3.7.6 or 3.8.6 or 3.9.4 or 4.0.2 or 4.1.2
CVE-2015-3438Apr 21, 2015
Medium6.1
Reflected Cross-Site Scripting
Shortcode Factory
≤1.1Update to 1.1.1
CVE-2015-9321Apr 21, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
CVE-2015-9505Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – Manual Purchases
<1.9.1Update to 1.9.1
CVE-2015-9517Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – Content Restriction
≤2.0.7Update to 2.0.8
CVE-2015-9509Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – Pushover notifications
≤1.2.8Update to 1.2.9
CVE-2015-9521Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy US Sales Taxes Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9369Apr 20, 2015
Medium6.1
Quota < 1.2.5 - Cross-Site Scripting
Easy Digital Downloads - Quota
<1.2.5Update to 1.2.5
CVE-2015-9534Apr 20, 2015