CWE-200Vulnerability type

WordPress Information Exposure vulnerabilities (page 1348)

Debug logs, backups and exports left reachable without authentication.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Information Exposure vulnerabilities (page 1348)
Severity	Vulnerability	CVE	Installs	Published
Medium5.3	Information Disclosure Portable phpMyAdmin≤1.4.1No patch available	CVE-2013-4454	—	Aug 1, 2014
Medium6.4	Stored Cross-Site Scripting BuddyPress≤1.9.1Update to 1.9.2	CVE-2014-1888	—	Aug 1, 2014
Medium5.3	Full Path Disclosure WP PHP widget≤1.0.2No patch available	CVE-2013-0721	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Count per Day≤3.1.1Update to 3.2	CVE-2012-3434	—	Aug 1, 2014
Critical9.8	Arbitrary File Upload MailPoet Newsletters (Previous)≤2.6.6Update to 2.6.7	CVE-2014-4725	—	Aug 1, 2014
High7.2	Stored Cross-Site Scripting PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links<1.6.3Update to 1.6.3	CVE-2013-1636	—	Aug 1, 2014
Critical9.8	Unauthenticated Command Injection EZPZ One Click Backup≤12.03.10No patch available	CVE-2014-3114	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Xhanch – My Twitter≤2.7.6Update to 2.7.7	CVE-2013-3253	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting WP App Maker≤1.0.16.4No patch available	CVE-2014-4578	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Tweet Blender≤4.0.1Update to 4.0.2	CVE-2013-6342	—	Aug 1, 2014
Medium6.1	Open Redirection WP Symposium≤13.04Update to 13.05	CVE-2013-2694	—	Aug 1, 2014
Medium6.3	Cross-Site Request Forgery WordPress Content Slide≤1.4.2No patch available	CVE-2013-2708	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Stream Video Player≤1.4.1No patch available	CVE-2013-2706	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting Redirection<2.2.9Update to 2.2.9	CVE-2011-5329	—	Aug 1, 2014
Medium6.1	Cross-Site scripting Hot Files: File Sharing and Download Manager Plugin≤1.0.0No patch available	CVE-2014-4588	—	Aug 1, 2014
Critical9.8	Remote Code Execution WP Super Cache<1.3.2Update to 1.3.2	CVE-2013-2011	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Disable Comments<1.0.4Update to 1.0.4	CVE-2014-2550	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting BulletProof Security≤.48.9Update to .49	CVE-2013-3487	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider≤2.5Update to 2.6	CVE-2014-4846	—	Aug 1, 2014
High8.8	Remote Code Execution WP Super Cache≤1.2Update to 1.3	CVE-2013-2009	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Adminimize≤1.7.21Update to 1.7.22	CVE-2011-4926	—	Aug 1, 2014
High7.3	Authentication Bypass Portable phpMyAdmin≤1.3.0Update to 1.3.1	CVE-2012-5469	—	Aug 1, 2014
High8.1	Unauthenticated Local File Inclusion Tinymce Thumbnail Gallery≤1.0.0Update to 1.1.0	CVE-2012-20002	—	Aug 1, 2014
Medium4.3	Cross-Site Request Forgery Calendar≤1.3.2Update to 1.3.3	CVE-2013-2698	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting wp-media-player≤0.8No patch available	CVE-2014-4589	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Events Manager Pro<2.2.9Update to 2.2.9	CVE-2013-1407	—	Aug 1, 2014
Medium6.5	Cross-Site Request Forgery wp-html-sitemap≤1.2No patch available	CVE-2014-2675	—	Aug 1, 2014
High7.1	Cross-Site Request Forgery to Stored Cross-Site Scripting Quick Page/Post Redirect Plugin<5.0.5Update to 5.0.5	CVE-2014-2598	—	Aug 1, 2014
Medium6.1	Reflected Cross Site Scripting WHOIS≤1.4.2.2Update to 1.4.2.3	CVE-2011-5194	—	Aug 1, 2014
Critical9.9	Authenticated SQL Injection BSK PDF Manager<1.5Update to 1.5	CVE-2014-4944	—	Aug 1, 2014

Medium5.3
Information Disclosure
Portable phpMyAdmin
≤1.4.1No patch available
CVE-2013-4454Aug 1, 2014
Medium6.4
Stored Cross-Site Scripting
BuddyPress
≤1.9.1Update to 1.9.2
CVE-2014-1888Aug 1, 2014
Medium5.3
Full Path Disclosure
WP PHP widget
≤1.0.2No patch available
CVE-2013-0721Aug 1, 2014
Medium6.1
Cross-Site Scripting
Count per Day
≤3.1.1Update to 3.2
CVE-2012-3434Aug 1, 2014
Critical9.8
Arbitrary File Upload
MailPoet Newsletters (Previous)
≤2.6.6Update to 2.6.7
CVE-2014-4725Aug 1, 2014
High7.2
Stored Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.6.3Update to 1.6.3
CVE-2013-1636Aug 1, 2014
Critical9.8
Unauthenticated Command Injection
EZPZ One Click Backup
≤12.03.10No patch available
CVE-2014-3114Aug 1, 2014
High8.8
Cross-Site Request Forgery
Xhanch – My Twitter
≤2.7.6Update to 2.7.7
CVE-2013-3253Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
WP App Maker
≤1.0.16.4No patch available
CVE-2014-4578Aug 1, 2014
Medium6.1
Cross-Site Scripting
Tweet Blender
≤4.0.1Update to 4.0.2
CVE-2013-6342Aug 1, 2014
Medium6.1
Open Redirection
WP Symposium
≤13.04Update to 13.05
CVE-2013-2694Aug 1, 2014
Medium6.3
Cross-Site Request Forgery
WordPress Content Slide
≤1.4.2No patch available
CVE-2013-2708Aug 1, 2014
High8.8
Cross-Site Request Forgery
Stream Video Player
≤1.4.1No patch available
CVE-2013-2706Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
Redirection
<2.2.9Update to 2.2.9
CVE-2011-5329Aug 1, 2014
Medium6.1
Cross-Site scripting
Hot Files: File Sharing and Download Manager Plugin
≤1.0.0No patch available
CVE-2014-4588Aug 1, 2014
Critical9.8
Remote Code Execution
WP Super Cache
<1.3.2Update to 1.3.2
CVE-2013-2011Aug 1, 2014
High8.8
Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
CVE-2014-2550Aug 1, 2014
Medium6.1
Cross-Site Scripting
BulletProof Security
≤.48.9Update to .49
CVE-2013-3487Aug 1, 2014
Medium6.1
Cross-Site Scripting
Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
≤2.5Update to 2.6
CVE-2014-4846Aug 1, 2014
High8.8
Remote Code Execution
WP Super Cache
≤1.2Update to 1.3
CVE-2013-2009Aug 1, 2014
Medium6.1
Cross-Site Scripting
Adminimize
≤1.7.21Update to 1.7.22
CVE-2011-4926Aug 1, 2014
High7.3
Authentication Bypass
Portable phpMyAdmin
≤1.3.0Update to 1.3.1
CVE-2012-5469Aug 1, 2014
High8.1
Unauthenticated Local File Inclusion
Tinymce Thumbnail Gallery
≤1.0.0Update to 1.1.0
CVE-2012-20002Aug 1, 2014
Medium4.3
Cross-Site Request Forgery
Calendar
≤1.3.2Update to 1.3.3
CVE-2013-2698Aug 1, 2014
Medium6.1
Cross-Site Scripting
wp-media-player
≤0.8No patch available
CVE-2014-4589Aug 1, 2014
Medium6.1
Cross-Site Scripting
Events Manager Pro
<2.2.9Update to 2.2.9
CVE-2013-1407Aug 1, 2014
Medium6.5
Cross-Site Request Forgery
wp-html-sitemap
≤1.2No patch available
CVE-2014-2675Aug 1, 2014
High7.1
Cross-Site Request Forgery to Stored Cross-Site Scripting
Quick Page/Post Redirect Plugin
<5.0.5Update to 5.0.5
CVE-2014-2598Aug 1, 2014
Medium6.1
Reflected Cross Site Scripting
WHOIS
≤1.4.2.2Update to 1.4.2.3
CVE-2011-5194Aug 1, 2014
Critical9.9
Authenticated SQL Injection
BSK PDF Manager
<1.5Update to 1.5
CVE-2014-4944Aug 1, 2014