CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1341)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Authenticated Stored Cross-Site Scripting
Simple Security
≤1.1.5Update to 1.1.6
- Medium6.1Stored Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
<3.5.6Update to 3.5.6
- Medium6.1Cross-Site Scripting
Pods – Custom Content Types and Fields
≤2.4.3Update to 2.5
- Critical9.6Multiple Cross-Site Request Forgery
Pods – Custom Content Types and Fields
≤2.4.3Update to 2.5
- Critical9.8Unauthenticated Blind SQL Injection via order_by Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.8Update to 1.2.8
- Medium6.1Reflected Cross-Site Scripting
Greg's High Performance SEO
<1.6.2Update to 1.6.2
- High8.8Arbitrary File Upload
WP EasyCart: Shopping Cart and eCommerce Store
<3.0.16Update to 3.0.16
- Medium6.1Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
<3.9.3Update to 3.9.3
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
simpleflickr
≤3.0.3No patch available
- Medium6.1Cross-Site Scripting
Relevanssi – A Better Search
<3.3.8Update to 3.3.8
- High8.8Cross-Site Request Forgery
Banner Effect Header
<1.2.8Update to 1.2.8
- Medium6.5WordPress Ecommerce < 1.5.4 - Directory Traversal to Arbitrary File Disclosure
Cart66 Lite :: WordPress Ecommerce
<1.5.4Update to 1.5.4
- High7.5Arbitrary File Read
Sell Downloads
≤1.0.1Update to 1.0.2
- Critical9.8Arbitrary File Upload
cformsII
<14.8Update to 14.8
- Medium6.1Cross-Site Scripting
Frontend Uploader
<0.9.4Update to 0.9.4
- High8.8SQL Injection
Cart66 Lite :: WordPress Ecommerce
<1.5.4Update to 1.5.4
- Medium6.1Reflected Cross-Site Scripting
wordpress-backup-to-dropbox
<4.1Update to 4.1
- High8.8Cross-Site Request Forgery
gSlideShow
≤0.1No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Post to Twitter
≤0.7No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
PWGRandom
≤1.11No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
wp-unique-article-header-image
≤1.0No patch available
- Medium6.1Cross-Site Request Forgery
PictoBrowser
≤0.3.1No patch available
- High8.8Cross-Site Request Forgery leading to Cross-Site Scripting
wp-limit-posts-automatically
≤0.7No patch available
- High7.5Directory Traversal
Slider Revolution
≤4.1.4Update to 4.2
- High7.2Cross-Site Scripting
Slider Revolution
≤4.2.2Update to 4.2.3
- High7.5Directory Traversal
DB Backup
<5.0Update to 5.0
- Medium5.4Cross-Site Scripting
W3 Total Cache
≤0.9.4Update to 0.9.4.1
- Medium6.1Cross-Site Scripting
iTwitter
≤0.04No patch available
- High8.8Cross-Site Request Forgery and Stored Cross-Site Scripting
Sliding Social Icons
≤1.61No patch available
- Medium6.1Cross-Site Scripting
wpCommentTwit
≤0.5No patch available