CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1363)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.4 | Cross-Site Scripting | CVE-2012-2403 | — | |
| High7.2 | Cross-Site Scripting | CVE-2012-2400 | — | |
| Medium5.4 | Authorization Bypass | CVE-2012-2402 | — | |
| Critical9.8 | Multiple Vulnerabilities | CVE-2012-4033 | — | |
| High7.5 | Path Disclosure | CVE-2012-6512 | — | |
| High7.1 | Cross-Site Scripting | CVE-2012-1835 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10019 | — | |
| High7.2 | Arbitrary File Upload | CVE-2012-4874 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-5913 | — | |
| Critical9.8 | 1.5-1.5.4 - SQL Injection | CVE-2012-2109 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-1834 | — | |
| High8.3 | Server Side Request Forgery to Cross-Site Scirpting | CVE-2012-10018 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2012-5318 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3576 | — | |
| High7.2 | Remote Code Execution | CVE-2012-1785 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2012-1786 | — | |
| High7.2 | Cross-Site Scripting | CVE-2011-5082 | — | |
| High8.8 | SQL Injection | CVE-2012-10009 | — | |
| High7.1 | Cross-Site Scripting | CVE-2012-5229 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-1125 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2012-0934 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-1011 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-1010 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2012-5325 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6527 | — | |
| Medium5.3 | Directory Traversal | CVE-2012-0898 | — | |
| High7.5 | Arbitrary File Download | CVE-2012-0896 | — | |
| Medium6.1 | Open Redirect | CVE-2012-6499 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-0901 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2012-5350 | — |
- Medium6.4Cross-Site Scripting
WordPress
≤3.3.1Update to 3.3.2
- High7.2Cross-Site Scripting
WordPress
≤3.3.1Update to 3.3.2
- Medium5.4Authorization Bypass
WordPress
≤3.3.1Update to 3.3.2
- Critical9.8Multiple Vulnerabilities
zingiri-web-shop
<2.4.0Update to 2.4.0
- High7.5Path Disclosure
Organizer
≤1.2.1No patch available
- High7.1Cross-Site Scripting
Timely All-in-One Events Calendar
<1.6Update to 1.6
- Critical9.8Arbitrary File Upload
Front-end Editor
<2.3Update to 2.3
- High7.2Arbitrary File Upload
AWP Classifieds
<2.0Update to 2.0
- Medium6.1Cross-Site Scripting
WordPress Integrator
≤1.32No patch available
- Critical9.81.5-1.5.4 - SQL Injection
BuddyPress
1.5 – 1.5.4Update to 1.5.5
- Medium6.1Cross-Site Scripting
CMS Tree Page View – Reorder Pages with a Drag-and-Drop Tree
<0.8.9Update to 0.8.9
- High8.3Server Side Request Forgery to Cross-Site Scirpting
Mapplic Lite
<1.0.1Update to 1.0.1
- Critical9.8Unauthenticated Arbitrary File Upload
Kish Guest Posting
≤1.2No patch available
- Critical9.8Arbitrary File Upload
IDB Ecommerce (wpStoreCart 5)
≤2.5.29Update to 2.5.30
- High7.2Remote Code Execution
Videopack
<2.0Update to 2.0
- Medium5.3Full Path Disclosure
Videopack
≤1.1Update to 2.0
- High7.2Cross-Site Scripting
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
<111220Update to 111220
- High8.8SQL Injection
404Like
≤1.0Update to 1.0.2
- High7.1Cross-Site Scripting
Slideshow Gallery
≤1.1.4No patch available
- Critical9.8Arbitrary File Upload
Kish Guest Posting
<1.2Update to 1.2
- Critical9.8Remote File Inclusion
Theme Tuner
<0.8Update to 0.8
- Critical9.8Arbitrary File Upload
AllWebMenus WordPress Menu Plugin
≤1.1.8Update to 1.1.9
- Critical9.8Arbitrary File Upload
AllWebMenus WordPress Menu Plugin
<1.1.9Update to 1.1.9
- Medium5.4Cross-Site Scripting
Shortcode Redirect
≤1.0.01Update to 1.0.02
- Medium6.1Cross-Site Scripting
My Calendar – Accessible Event Manager
<1.10.5Update to 1.10.5
- Medium5.3Directory Traversal
myEASYbackup
<1.0.9Update to 1.0.9
- High7.5Arbitrary File Download
Count per Day
≤3.1Update to 3.1.1
- Medium6.1Open Redirect
Age Verification
≤0.4Update to 0.5
- Medium6.1Cross-Site Scripting
YouSayToo auto-publishing plugin
≤1.0No patch available
- High8.8Authenticated SQL Injection
Pay With Tweet
≤1.1Update to 1.2