CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1352)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4597 | — | |
| Critical9.8 | SQL Injection | CVE-2014-4938 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2014-5182 | — | |
| High7.5 | Directory Traversal | CVE-2014-4940 | — | |
| High8.8 | SQL Injection | CVE-2014-5185 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4538 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4544 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4528 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2014-4942 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4605 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2014-9292 | — | |
| High7.5 | Path Traversal | CVE-2014-4937 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4527 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4574 | — | |
| Critical9.1 | Authenticated (Admin+) SQL Injection | CVE-2014-5180 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4514 | — | |
| Medium5.3 | Directory Traversal | CVE-2014-5181 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2014-5186 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2014-4939 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4554 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2014-4526 | — | |
| High7.2 | SQL Injection | CVE-2014-5184 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4547 | — | |
| Medium6.1 | CBI Referral Manager <= 1.2.1 Cross-Site Scripting | CVE-2014-4517 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4599 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4539 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4561 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4542 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4576 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4522 | — |
- Medium6.1Reflected Cross-Site Scripting
WordPress Social Invitations – Lite
≤1.4.4.2Update to 1.4.4.3
- Critical9.8SQL Injection
WP Rss Poster
≤1.0.0No patch available
- High8.8Authenticated SQL Injection
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.1Update to 1.2.2
- High7.5Directory Traversal
Tera Charts
≤0.1Update to 1.0
- High8.8SQL Injection
quartz
≤1.01.1No patch available
- High7.1Cross-Site Scripting
Malware Finder
≤1.1No patch available
- Medium6.1Cross-Site Scripting
Podcast Channels
<0.21Update to 0.21
- Medium6.1Cross-Site Scripting
Bugs Go Viral : Facebook Promotion Generator
≤1.3.4No patch available
- Medium5.3Sensitive Information Disclosure
WP EasyCart: Shopping Cart and eCommerce Store
≤2.0.5Update to 2.0.6
- Medium6.1Cross-Site Scripting
ZdStatistics
≤2.0.1No patch available
- High7.5Server-Side Request Forgery
jRSS Widget
≤1.2No patch available
- High7.5Path Traversal
BookX
≤1.7No patch available
- Medium6.1Cross-Site Scripting
EnvíaloSimple: Email Marketing y Newsletters
≤1.97Update to 1.98
- Medium6.1Cross-Site Scripting
WebEngage Feedback, Survey and Notification
<2.0.1Update to 2.0.1
- Critical9.1Authenticated (Admin+) SQL Injection
HDW Player Plugin (Video Player & Video Gallery)
≤2.4.2Update to 3.0
- Medium6.1Cross-Site Scripting
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
<3.7.0Update to 3.7.0
- Medium5.3Directory Traversal
lastfm-rotation
≤1.0No patch available
- High7.2Authenticated SQL Injection
All Video Gallery Plugin for WordPress
≤1.2No patch available
- High7.2Authenticated (Admin+) SQL Injection
ENL Newsletter
≤1.0.1No patch available
- Medium6.1Cross-Site Scripting
SS Downloads
≤1.4.4.1Update to 1.5
- Medium6.1Multiple Cross-Site Scripting
efence
≤1.3.2No patch available
- High7.2SQL Injection
stripshow
≤2.5.2No patch available
- Medium6.1Cross-Site Scripting
Rezgo Online Booking
<1.8.2Update to 1.8.2
- Medium6.1CBI Referral Manager <= 1.2.1 Cross-Site Scripting
CBI Referral Manager
≤1.2.1No patch available
- Medium6.1Cross-Site Scripting
WP-Business Directory
≤1.0.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Movies
≤0.6No patch available
- Medium6.1Reflected Cross-Site Scripting
Local Weather
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
ooorl
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
WordPress Social Login
≤2.1.5Update to 2.1.6
- Medium6.1Reflected Cross-Site Scripting
dsSearchAgent: WordPress Edition
<1.0-beta10No patch available