CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1361)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-10014 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-10013 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2012-10017 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2012-10015 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6714 | — | |
| Critical9.8 | Directory Traversal | CVE-2012-6652 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-20005 | — | |
| Medium6.1 | Cross-Site Request Forgery | CVE-2013-2108 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6713 | — | |
| Medium4.3 | Sensitive Information Disclosure | CVE-2012-6635 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2012-6634 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2012-3384 | — | |
| Medium6.5 | Cross-Site Scripting | CVE-2012-6633 | — | |
| Medium4.3 | Information Disclosure | CVE-2012-3385 | — | |
| Low3.7 | Informational < 6.8 - Weak Hashing Algorithm | CVE-2012-6707 | — | |
| Critical9.8 | SQL Injection | CVE-2018-12534 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10020 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10011 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-6649 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3575 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10064 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-2633 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3574 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3578 | — | |
| Critical9.8 | Remote File Upload | CVE-2012-10027 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3577 | — | |
| Critical9.8 | Brute Force Bypass | CVE-2012-10001 | — | |
| High7.5 | Arbitrary File Read | CVE-2012-3588 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2012-6715 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10026 | — |
- Medium6.1Reflected Cross-Site Scripting
Backend Localization
≤2.0Update to 2.0.1
- Medium6.1Reflected Cross-Site Scripting
Backend Localization
1.6.1 – 1.6.1Update to 2.0
- Medium4.3Cross-Site Request Forgery
Portfolio Plugin
≤2.04Update to 2.05
- Medium4.3Cross-Site Request Forgery
BestWebSoft's Twitter
≤2.14Update to 2.15
- Medium6.1Cross-Site Scripting
Count per Day
<3.2.3Update to 3.2.3
- Critical9.8Directory Traversal
A Page Flip Book
<3.0Update to 3.0
- Medium6.1Reflected Cross-Site Scripting
socialfit
≤1.2.2No patch available
- Medium6.1Cross-Site Request Forgery
WP CleanFix
≤3.0.1Update to 3.0.2
- Medium6.1Cross-Site Scripting
Job Manager
≤0.7.18Update to 0.7.19
- Medium4.3Sensitive Information Disclosure
WordPress
<3.3.3Update to 3.3.3
- Medium5.3Sensitive Information Disclosure
WordPress
<3.3.3Update to 3.3.3
- High8.8Cross-Site Request Forgery
WordPress
≤3.4Update to 3.4.1
- Medium6.5Cross-Site Scripting
WordPress
<3.3.3Update to 3.3.3
- Medium4.3Information Disclosure
WordPress
≤3.4Update to 3.4.1
- Low3.7Informational < 6.8 - Weak Hashing Algorithm
WordPress
<6.8Update to 6.8
- Critical9.8SQL Injection
Quick Chat
<4.00Update to 4.00
- Critical9.8Arbitrary File Upload
FoxyPress
<0.4.2.2Update to 0.4.2.2
- Critical9.8Arbitrary File Upload
HD FLV PLayer
≤1.7Update to 1.8
- Critical9.8Arbitrary File Upload
WP GPX Maps – GPX, FIT & KML maps with elevation profile
<1.1.23Update to 1.1.23
- Critical9.8Arbitrary File Upload
rbxgallery
<3.1Update to 3.1
- Critical9.8Arbitrary File Upload
Omni Secure Files
≤0.1.13Update to 0.1.14
- Medium6.1Cross-Site Scripting
WassUp Real Time Analytics
<1.8.3.1Update to 1.8.3.1
- Critical9.8Arbitrary File Upload
mm-forms-community
≤2.2.6Update to 2.2.7
- Critical9.8Arbitrary File Upload
FCChat Widget
<2.2.13.7Update to 2.2.13.7
- Critical9.8Remote File Upload
WP-Property – WordPress Powered Real Estate and Property Management
≤1.35.0Update to 1.35.1
- Critical9.8Arbitrary File Upload
Nmedia WordPress Member Conversation
<1.4Update to 1.4
- Critical9.8Brute Force Bypass
Limit Login Attempts
≤1.7.0Update to 1.7.1
- High7.5Arbitrary File Read
Plugin: Newsletter
≤1.5No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
FormBuilder
≤0.90Update to 0.91
- Critical9.8Arbitrary File Upload
Asset Manager
≤0.3No patch available