CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1355)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | SQL Injection | CVE-2014-3937 | — | |
| Critical9.8 | SQL Injection | CVE-2014-10017 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-10016 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2014-1908 | — | |
| Critical9.8 | Arbitrary File Read/Deletion | CVE-2014-1907 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2014-1905 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-2297 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100023 | — | |
| Critical9.8 | SQL Injection | CVE-2014-100022 | — | |
| Medium5.3 | CAPTCHA Bypass | CVE-2014-2265 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-2315 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-10381 | — | |
| Critical9.8 | 3.9.4 - SQL Injection | CVE-2014-1854 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2014-2274 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-8800 | — | |
| Critical9.1 | SQL Injection | CVE-2014-2316 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-1906 | — | |
| Medium6.5 | Authorization Bypass | CVE-2014-1889 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2014-2040 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100016 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-125090 | — | |
| Medium6.1 | Open Redirect | CVE-2014-1750 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2012-6629 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-100026 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4563 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-1232 | — | |
| High7.5 | Directory Traversal | CVE-2013-7240 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-6992 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6991 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7276 | — |
- Critical9.8SQL Injection
Contextual Related Posts
<1.8.10.2Update to 1.8.10.2
- Critical9.8SQL Injection
Welcart e-Commerce
≤2.9.1Update to 2.9.2
- Medium6.1Cross-Site Scripting
Welcart e-Commerce
≤2.11.1Update to 2.11.2
- Medium5.3Full Path Disclosure
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Critical9.8Arbitrary File Read/Deletion
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Critical9.8Arbitrary File Upload
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.27.4Update to 4.29.5
- Medium6.1Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.29.6Update to 4.29.9
- Medium6.1Cross-Site Scripting
mTouch Quiz
<3.0.7Update to 3.0.7
- Critical9.8SQL Injection
mTouch Quiz
<3.0.7Update to 3.0.7
- Medium5.3CAPTCHA Bypass
Contact Form 7
<3.7.2Update to 3.7.2
- Medium6.1Cross-Site Scripting
Thank You Counter Button
≤1.9.3No patch available
- High8.8Cross-Site Request Forgery
User Domain Whitelist
<1.5Update to 1.5
- Critical9.83.9.4 - SQL Injection
AdRotate Banner Manager
3.9 – 3.9.4Update to 3.9.5
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Subscribe To Comments Reloaded
≤140129Update to 140219
- High7.1Cross-Site Scripting
Nextend Social Login and Register
<1.5.1Update to 1.5.1
- Critical9.1SQL Injection
Search Everything
<7.0.3Update to 7.0.3
- High7.1Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Medium6.5Authorization Bypass
BuddyPress
<1.9.2Update to 1.9.2
- Medium6.4Stored Cross-Site Scripting
Media File Renamer: Rename Images & Files for SEO (AI-Powered)
<1.9.4Update to 1.9.4
- Medium6.1Cross-Site Scripting
Photocrati
≤4.8.0Update to 4.8.1
- Medium6.1Reflected Cross-Site Scripting
Media Downloader
≤0.1.992Update to 0.1.993
- Medium6.1Open Redirect
Nokia Maps & Places
<1.6.7Update to 1.6.7
- High8.8Cross-Site Request Forgery
Newsletter Manager
<1.4Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
April's Super Functions Pack
≤1.4.7Update to 1.4.8
- Medium6.1Cross-Site Scripting
URL Cloak & Encrypt
<3.8.0Update to 3.8.0
- Medium6.1Cross-Site Scripting
Foliopress WYSIWYG
<2.6.8.5Update to 2.6.8.5
- High7.5Directory Traversal
Advanced Dewplayer
≤1.2Update to 1.3
- High8.8Cross-Site Request Forgery
AskApache Firefox Adsense
≤3.0No patch available
- Medium6.1Cross-Site Scripting
WP-Cron Dashboard
<1.1.6Update to 1.1.6
- Medium6.1Cross-Site Scripting
Recommend to a friend
≤2.2.2No patch available