CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1336)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2015-9527 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9520 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9513 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9294 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9368 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9523 | — | |
| Critical9.8 | SQL Injection | CVE-2015-3314 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9375 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9362 | — | |
| Medium5.4 | Cross-Site Scripting via Ephox in Plupload | CVE-2015-3439 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9529 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9376 | — | |
| Critical9.8 | SQL Injection | CVE-2015-3313 | — | |
| Medium6.1 | Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7 | CVE-2015-9512 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9356 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9370 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9374 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9519 | — | |
| Medium5.3 | Reflected Cross Site Scripting | CVE-2015-10098 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9365 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9533 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9511 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9363 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9525 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9522 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9535 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9371 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9514 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9364 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9369 | — |
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Simple Shipping
≤2.1.3Update to 2.1.4
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Per Product Emails
<1.0.9Update to 1.0.9
- Medium6.1Cross-Site Scripting
EDD Favorites
≤1.0.6Update to 1.0.7
- Medium6.1Reflected Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<3.9.5Update to 3.9.5
- Medium6.1Reflected Cross-Site Scripting
Easy EU Value Added (VAT) Taxes Add-on
<1.2.0Update to 1.2.0
- Medium6.1Cross-Site Scripting
Recommended Products - EDD
≤1.2.3.2Update to 1.2.3.3
- Critical9.8SQL Injection
Tune Library
<1.5.5Update to 1.5.5
- Medium6.1Cross-Site Scripting
exchange-addon-table-rate-shipping
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Post Connector
<1.0.4Update to 1.0.4
- Medium5.4Cross-Site Scripting via Ephox in Plupload
WordPress
≤4.1.1Update to 3.7.6 or 3.8.6 or 3.9.4 or 4.0.2 or 4.1.2
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads (EDD) Stripe
≤2.1.2Update to 2.1.3
- Medium6.1Reflected Cross-Site Scripting
Mobile
<1.2.8Update to 1.2.8
- Critical9.8SQL Injection
Community Events
≤1.3Update to 1.4
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
- Medium6.1Cross-Site Scripting
WP-ViperGB
<1.3.16Update to 1.3.16
- Medium6.1Reflected Cross-Site Scripting
Exchange Addon Invoices
<1.4.0Update to 1.4.0
- Medium6.1Reflected Cross-Site Scripting
Stripe Add-on for iThemes Exchange
<1.2.0Update to 1.2.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – PDF stamper
≤1.0No patch available
- Medium5.3Reflected Cross Site Scripting
Broken Link Checker
<1.10.6Update to 1.10.6
- Medium6.1Reflected Cross-Site Scripting
Authorize.net Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Lattice
<1.1.5Update to 1.1.5
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Conditional Success Redirects
<1.1.1Update to 1.1.1
- Medium6.1Cross-Site Scripting
ithemes-exchange
<1.12.0Update to 1.12.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads - Recurring Payments
≤2.3Update to 2.3.1
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads - QR Codes
≤1.1.0Update to 1.1.1
- Medium6.1Cross-Site Scripting
Shoppette
<1.0.5Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting
Manual Purchases Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads - Free Downloads
≤2.3.6Update to 2.3.7
- Medium6.1Reflected Cross-Site Scripting
2Checkout Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Easy US Sales Taxes Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
