CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1349)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2014-10378 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4856 | — | |
| High8.8 | SQL Injection | CVE-2012-5327 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-4954 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-3476 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1463 | — | |
| Medium6.1 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2013-2704 | — | |
| Medium4.7 | Cross-Site Request Forgery | CVE-2013-2705 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4581 | — | |
| High8.1 | Unauthenticated Local File Inclusion | CVE-2012-20002 | — | |
| High7.3 | Authentication Bypass | CVE-2012-5469 | — | |
| Medium6.1 | Cross-Site Scripting via Search Parameter | CVE-2013-5988 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-3434 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-2698 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-2708 | — | |
| Critical9.8 | Unauthenticated Command Injection | CVE-2014-3114 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2013-1636 | — | |
| Medium6.1 | Reflected Cross Site Scripting | CVE-2011-5194 | — | |
| High8.8 | SQL Injection | CVE-2012-5328 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3253 | — | |
| High8.8 | Remote Code Execution | CVE-2013-2009 | — | |
| Medium6.1 | Open Redirection | CVE-2013-2694 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2014-2675 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3487 | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-4664 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-9100 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-9099 | — | |
| Critical9.8 | SQL Injection | CVE-2014-5200 | — | |
| Critical9.8 | SQL Injection | CVE-2014-5189 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2014-9098 | — |
- Medium6.1Cross-Site Scripting
Yoast Duplicate Post
≤2.6Update to 3.0
- Medium6.1Cross-Site Scripting
Crowdsignal Dashboard – Polls, Surveys & more
≤2.0.24Update to 2.0.25
- High8.8SQL Injection
Mingle Forum
≤1.0.32.1Update to 1.0.33
- Medium6.1Multiple Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤1.30Update to 1.31
- Medium4.3Cross-Site Request Forgery
WordPress Related Posts
<2.7.2Update to 2.7.2
- Medium6.1Cross-Site Scripting
WP-Table Reloaded
≤1.9.3Update to 1.9.4
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Dropdown Menu Widget
≤1.9.7No patch available
- Medium4.7Cross-Site Request Forgery
Simple Shopping Cart
<3.6Update to 3.6
- Medium6.1Reflected Cross-Site Scripting
WPCB
≤2.4.8No patch available
- High8.1Unauthenticated Local File Inclusion
Tinymce Thumbnail Gallery
≤1.0.0Update to 1.1.0
- High7.3Authentication Bypass
Portable phpMyAdmin
≤1.3.0Update to 1.3.1
- Medium6.1Cross-Site Scripting via Search Parameter
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤2.0.3Update to 2.0.3.1
- Medium6.1Cross-Site Scripting
Count per Day
≤3.1.1Update to 3.2
- Medium4.3Cross-Site Request Forgery
Calendar
≤1.3.2Update to 1.3.3
- Medium6.3Cross-Site Request Forgery
WordPress Content Slide
≤1.4.2No patch available
- Critical9.8Unauthenticated Command Injection
EZPZ One Click Backup
≤12.03.10No patch available
- High7.2Stored Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.6.3Update to 1.6.3
- Medium6.1Reflected Cross Site Scripting
WHOIS
≤1.4.2.2Update to 1.4.2.3
- High8.8SQL Injection
Mingle Forum
<1.0.33Update to 1.0.33
- High8.8Cross-Site Request Forgery
Xhanch – My Twitter
≤2.7.6Update to 2.7.7
- High8.8Remote Code Execution
WP Super Cache
≤1.2Update to 1.3
- Medium6.1Open Redirection
WP Symposium
≤13.04Update to 13.05
- Medium6.5Cross-Site Request Forgery
wp-html-sitemap
≤1.2No patch available
- Medium6.1Cross-Site Scripting
BulletProof Security
≤.48.9Update to .49
- High7.2Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.1.3Update to 5.1.4
- Medium6.1Reflected Cross-Site Scripting
WhyDoWork AdSense
≤1.2No patch available
- High8.8Cross-Site Request Forgery
WhyDoWork AdSense
≤1.2No patch available
- Critical9.8SQL Injection
fbgorilla
all versionsNo patch available
- Critical9.8SQL Injection
Lead-Octopus-Power
<1.1.1Update to 1.1.1
- Medium5.4Cross-Site Scripting
WORDPRESS VIDEO GALLERY
≤2.5Update to 2.6