CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 1366)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.3 | Incorrect Authorization Checks | CVE-2011-5270 | — | |
| Medium4.3 | Incorrect Authorization for Contributor-level users | CVE-2011-1762 | — | |
| High7.5 | Denial of Service | CVE-2011-4957 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2011-4956 | — | |
| High7.5 | Path Traversal | CVE-2011-1669 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2011-4342 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2011-5304 | — | |
| High7.1 | Cross-Site Request Forgery | CVE-2011-0760 | — | |
| High8.8 | Multiple Cross-Site Request Forgery | CVE-2011-0759 | — | |
| High7.5 | Directory Traversal | CVE-2011-5208 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5307 | — | |
| Critical9.8 | SQL Injection | CVE-2011-1047 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2011-10041 | — | |
| High8.8 | Arbitrary File Upload | CVE-2013-1916 | — | |
| Critical9.8 | SQL Injection | CVE-2011-5308 | — | |
| Medium4.3 | Improper Authorization to Information Disclosure | CVE-2011-0701 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2011-3818 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-0740 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-0641 | — | |
| Medium5.4 | Missing Authorization | CVE-2010-5296 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2010-4536 | — | |
| High7.1 | Cross-Site Scripting | CVE-2010-4277 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-4747 | — | |
| Medium6.3 | Access Control Bypass | CVE-2010-5106 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-4518 | — | |
| High7.1 | Reflected Cross-Site Scripting | CVE-2010-4825 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-4779 | — | |
| Medium5.3 | Spam Protection Bypass | CVE-2010-5293 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2010-5295 | — | |
| High8.8 | SQL Injection | CVE-2010-4257 | — |
- Medium6.3Incorrect Authorization Checks
WordPress
<3.0.6Update to 3.0.6
- Medium4.3Incorrect Authorization for Contributor-level users
WordPress
≤3.1.1Update to 3.1.2
- High7.5Denial of Service
WordPress
<3.1.1Update to 3.1.1
- Medium6.4Cross-Site Scripting
WordPress
≤3.1Update to 3.1.1
- High7.5Path Traversal
WP Custom Pages
≤0.5.0.1No patch available
- Critical9.8Remote File Inclusion
BackWPup – WordPress Backup & Restore Plugin
≤1.7.1Update to 1.7.2
- Medium6.1Multiple Cross-Site Scripting
SodaHead Polls
<2.0.4Update to 2.0.4
- High7.1Cross-Site Request Forgery
WP Related Posts
<1.1Update to 1.1
- High8.8Multiple Cross-Site Request Forgery
WP-reCAPTCHA
≤2.9.8.2Update to 3.0
- High7.5Directory Traversal
BackWPup – WordPress Backup & Restore Plugin
<1.4.1Update to 1.4.1
- Medium6.1Cross-Site Scripting
photosmash-galleries
<1.0.5Update to 1.0.5
- Critical9.8SQL Injection
WP Forum Server
≤1.6.5Update to 1.6.6
- Critical9.8Arbitrary File Upload
Uploadify
≤1.0No patch available
- High8.8Arbitrary File Upload
User Photo
≤0.9.4Update to 0.9.5
- Critical9.8SQL Injection
CDN Vote
<0.4.2Update to 0.4.2
- Medium4.3Improper Authorization to Information Disclosure
WordPress
≤3.0.4Update to 3.0.5
- High7.5Sensitive Information Disclosure
WordPress
≤3.0.4Update to 3.0 or 3.0.5
- Medium6.1Cross-Site Scripting
RSS Feed Reader
≤0.1No patch available
- Medium6.1Cross-Site Scripting
StatPressCN
≤1.9.0Update to 1.9.1
- Medium5.4Missing Authorization
WordPress
<3.0.2Update to 3.0.2
- Medium6.4Cross-Site Scripting
WordPress
≤3.0.3Update to 3.0.4
- High7.1Cross-Site Scripting
Embedded Video
≤4.1No patch available
- Medium6.1Cross-Site Scripting
WordPress Processing Embed
≤0.5.1No patch available
- Medium6.3Access Control Bypass
WordPress
≤3.0.2Update to 3.0.3
- Medium6.1Cross-Site Scripting
WP Safe Search
≤0.7No patch available
- High7.1Reflected Cross-Site Scripting
Peadig's Twitter Feed: Embedded Timeline WordPress Plugin
≤2.2No patch available
- Medium6.1Cross-Site Scripting
WPtouch – Make your WordPress Website Mobile-Friendly
<1.9.20Update to 1.9.20
- Medium5.3Spam Protection Bypass
WordPress
<3.0.2Update to 3.0.2
- Medium6.4Cross-Site Scripting
WordPress
<3.0.2Update to 3.0.2
- High8.8SQL Injection
WordPress
≤3.0.1Update to 3.0.2