CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1358)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2013-6280 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-3258 | — | |
| High8.8 | Remote Code Execution | CVE-2013-2109 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2107 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-10021 | — | |
| Critical9.8 | SQL Injection | CVE-2013-3478 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-3257 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3252 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3477 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3479 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-2707 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3254 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-2702 | — | |
| High7.6 | Cross-Site Request Forgery | CVE-2013-2703 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2013-2709 | — | |
| High7.1 | Cross-Site Request Forgery | CVE-2013-2696 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-10028 | — | |
| Critical9.8 | SQL Injection | CVE-2013-3532 | — | |
| Critical9.8 | SQL Injection | CVE-2013-3530 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3526 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-1949 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-2697 | — | |
| High7.1 | Cross-Site Request Forgery | CVE-2013-2693 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2013-3720 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-7476 | — | |
| High7.2 | Cross-Site Scripting | CVE-2013-3529 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2700 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2741 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2743 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2013-2744 | — |
- Medium6.1Cross-Site Scripting
Social Sharing Toolkit
<2.1.2Update to 2.1.2
- Medium6.3Cross-Site Request Forgery
digg-digg
<5.3.5Update to 5.3.5
- High8.8Remote Code Execution
WP CleanFix
<5.0.0Update to 5.0.0
- High8.8Cross-Site Request Forgery
Mail On Update
<5.3.0Update to 5.3.0
- Medium6.1Reflected Cross-Site Scripting
Debug Bar
≤0.8Update to 0.8.1
- Critical9.8SQL Injection
WORDPRESS VIDEO GALLERY
<2.1Update to 2.1
- Medium4.3Cross-Site Request Forgery
Related Posts
<2.7.2Update to 2.7.2
- High8.8Cross-Site Request Forgery
WP-PostViews
<1.63Update to 1.63
- High8.8Cross-Site Request Forgery
Related Posts by Zemanta
≤1.3.1Update to 1.3.2
- High8.8Cross-Site Request Forgery
share-this
≤7.0.5Update to 7.0.6
- Medium6.3Cross-Site Request Forgery
AJAX Auth – Fast Logins, 2FA, Redirects
<3.1Update to 3.1
- Medium6.1Cross-Site Scripting
WP Photo Album Plus
<5.0.3Update to 5.0.3
- Medium6.3Cross-Site Request Forgery
Easy Plugin for AdSense
<6.10Update to 6.10
- High7.6Cross-Site Request Forgery
Facebook Members
<5.0.5Update to 5.0.5
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
FourSquare Checkins
<1.3Update to 1.3
- High7.1Cross-Site Request Forgery
WP Webmaster
<8.2.4Update to 8.2.4
- Medium6.1Reflected Cross-Site Scripting
EELV Newsletter
≤3.3.0Update to 3.3.1
- Critical9.8SQL Injection
SpiderVPlayer
≤2.1No patch available
- Critical9.8SQL Injection
Spiffy XSPF Player
≤0.1No patch available
- Medium6.1Cross-Site Scripting
Traffic Analyzer
≤3.4.1Update to 3.4.2
- Critical9.8Arbitrary File Upload
Social Media Widget
≤4.0Update to 4.0.1
- Medium6.1Cross-Site Scripting
wp-download-manager
<1.61Update to 1.61
- High7.1Cross-Site Request Forgery
WP-Print
<2.52Update to 2.52
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Feedweb
<1.9Update to 1.9
- High8.8Cross-Site Request Forgery
Simple Fields
<1.2Update to 1.2
- High7.2Cross-Site Scripting
WP FuneralPress
≤1.1.6Update to 1.1.7
- High8.8Cross-Site Request Forgery
WP125
≤1.4.9Update to 1.5.0
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0
- Medium5.3Sensitive Information Disclosure
BackupBuddy
<3.0Update to 3.0