CWE-200Vulnerability type

WordPress Information Exposure vulnerabilities (page 1351)

Debug logs, backups and exports left reachable without authentication.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Information Exposure vulnerabilities (page 1351)
Severity	Vulnerability	CVE	Installs	Published
High7.1	Cross-Site Scripting wp-tmkm-amazon<1.5.3Update to 1.5.3	CVE-2014-4598	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting VideoWhisper Video Presentation≤3.25Update to 3.31	CVE-2014-4570	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting WordPress Responsive Preview<1.2Update to 1.2	CVE-2014-4594	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting WP Consultant≤1.0No patch available	CVE-2014-4582	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting wp-football≤1.1No patch available	CVE-2014-4586	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting Appointments Scheduler≤1.5No patch available	CVE-2014-4579	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting Webcam Microphone Screen Recorder – Media Capture≤1.55.4Update to 1.55.5	CVE-2014-4568	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting Ruven Toolkit≤2.0No patch available	CVE-2014-4548	—	Jun 12, 2014
High7.1	Cross-Site Scripting WP Microblogs≤0.4.0No patch available	CVE-2014-4590	—	Jun 12, 2014
Medium4.3	Cross-Site Request Forgery leading to player deletion JW Player for Flash & HTML5 Video<2.1.4Update to 2.1.4	CVE-2014-4030	—	Jun 10, 2014
High8.8	Cross-Site Request Forgery Featured Comments<1.2.5Update to 1.2.5	CVE-2014-4163	—	Jun 10, 2014
Medium6.1	Cross-Site Scripting Member Approval≤131109No patch available	CVE-2014-3850	—	Jun 10, 2014
Medium6.1	Reflected Cross-Site Scripting Disqus Comment System<2.76Update to 2.76	CVE-2014-5345	—	Jun 9, 2014
Critical9.8	SQL Injection Participants Database<1.5.4.9Update to 1.5.4.9	CVE-2014-3961	—	Jun 2, 2014
High7.2	Cross-Site Scripting simple-popup-images≤1.0Update to 1.1	CVE-2014-3921	—	May 30, 2014
High7.5	Path Traversal Cross-RSS≤1.7No patch available	CVE-2014-4941	—	May 29, 2014
Medium6.1	Cross-Site Scripting wppm≤1.6.4.bNo patch available	CVE-2014-4593	—	May 28, 2014
Medium6.1	Cross-Site Scripting Jigoshop Swipe plugin≤3.1.0No patch available	CVE-2014-4557	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting swipehq-payment-gateway-woocommerce≤2.7.1No patch available	CVE-2014-4558	—	May 28, 2014
Medium6.1	Cross-Site Scripting OMFG Mobile Pro≤1.1.26No patch available	CVE-2014-4541	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting Conversador≤2.61No patch available	CVE-2014-4519	—	May 28, 2014
Medium6.1	Cross-Site Scripting Validated≤1.0.2Update to 2.0.0	CVE-2014-4564	—	May 28, 2014
Medium6.1	Cross-Site Scripting Rezgo Online Booking<1.4.3Update to 1.4.3	CVE-2014-4546	—	May 28, 2014
High7.1	Cross-Site Scripting Oleggo LiveStream≤0.2.6No patch available	CVE-2014-4540	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting ActiveHelper LiveHelp Live Chat<3.1.5Update to 3.1.5	CVE-2014-4513	—	May 28, 2014
Medium6.1	Unauthenticated Cross-Site Scripting Easy Career Openings≤0.4No patch available	CVE-2014-4523	—	May 28, 2014
Medium5.3	Sensitive Information Disclosure WP EasyCart: Shopping Cart and eCommerce Store≤2.0.5Update to 2.0.6	CVE-2014-4942	—	May 28, 2014
Medium6.1	Cross-Site Scripting your-text-manager≤0.3.0No patch available	CVE-2014-4604	—	May 28, 2014
High8.8	Authenticated SQL Injection YAWPP (Yet Another WordPress Petition Plugin)≤1.2.1Update to 1.2.2	CVE-2014-5182	—	May 28, 2014
High7.5	Directory Traversal Tera Charts≤0.1Update to 1.0	CVE-2014-4940	—	May 28, 2014

High7.1
Cross-Site Scripting
wp-tmkm-amazon
<1.5.3Update to 1.5.3
CVE-2014-4598Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
VideoWhisper Video Presentation
≤3.25Update to 3.31
CVE-2014-4570Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
WordPress Responsive Preview
<1.2Update to 1.2
CVE-2014-4594Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
WP Consultant
≤1.0No patch available
CVE-2014-4582Jun 12, 2014
Medium6.1
Cross-Site Scripting
wp-football
≤1.1No patch available
CVE-2014-4586Jun 12, 2014
Medium6.1
Cross-Site Scripting
Appointments Scheduler
≤1.5No patch available
CVE-2014-4579Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
Webcam Microphone Screen Recorder – Media Capture
≤1.55.4Update to 1.55.5
CVE-2014-4568Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
Ruven Toolkit
≤2.0No patch available
CVE-2014-4548Jun 12, 2014
High7.1
Cross-Site Scripting
WP Microblogs
≤0.4.0No patch available
CVE-2014-4590Jun 12, 2014
Medium4.3
Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
CVE-2014-4030Jun 10, 2014
High8.8
Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
CVE-2014-4163Jun 10, 2014
Medium6.1
Cross-Site Scripting
Member Approval
≤131109No patch available
CVE-2014-3850Jun 10, 2014
Medium6.1
Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
CVE-2014-5345Jun 9, 2014
Critical9.8
SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
CVE-2014-3961Jun 2, 2014
High7.2
Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
CVE-2014-3921May 30, 2014
High7.5
Path Traversal
Cross-RSS
≤1.7No patch available
CVE-2014-4941May 29, 2014
Medium6.1
Cross-Site Scripting
wppm
≤1.6.4.bNo patch available
CVE-2014-4593May 28, 2014
Medium6.1
Cross-Site Scripting
Jigoshop Swipe plugin
≤3.1.0No patch available
CVE-2014-4557May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
swipehq-payment-gateway-woocommerce
≤2.7.1No patch available
CVE-2014-4558May 28, 2014
Medium6.1
Cross-Site Scripting
OMFG Mobile Pro
≤1.1.26No patch available
CVE-2014-4541May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
Conversador
≤2.61No patch available
CVE-2014-4519May 28, 2014
Medium6.1
Cross-Site Scripting
Validated
≤1.0.2Update to 2.0.0
CVE-2014-4564May 28, 2014
Medium6.1
Cross-Site Scripting
Rezgo Online Booking
<1.4.3Update to 1.4.3
CVE-2014-4546May 28, 2014
High7.1
Cross-Site Scripting
Oleggo LiveStream
≤0.2.6No patch available
CVE-2014-4540May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
CVE-2014-4513May 28, 2014
Medium6.1
Unauthenticated Cross-Site Scripting
Easy Career Openings
≤0.4No patch available
CVE-2014-4523May 28, 2014
Medium5.3
Sensitive Information Disclosure
WP EasyCart: Shopping Cart and eCommerce Store
≤2.0.5Update to 2.0.6
CVE-2014-4942May 28, 2014
Medium6.1
Cross-Site Scripting
your-text-manager
≤0.3.0No patch available
CVE-2014-4604May 28, 2014
High8.8
Authenticated SQL Injection
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.1Update to 1.2.2
CVE-2014-5182May 28, 2014
High7.5
Directory Traversal
Tera Charts
≤0.1Update to 1.0
CVE-2014-4940May 28, 2014