CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 14)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.33.4.0 - Two-Factor Authentication Bypass
Limit Login Attempts Security
3.0.0 – 3.4.0Update to 3.4.1
- Medium4.3Two-Factor Authentication Bypass
Limit Login Attempts Security
≤3.4.0Update to 3.4.1
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Grand Job
≤1.2.1No patch available
- Critical9.8Unauthenticated Administrator Credential Exposure
EASY-JS-WPAPI Client HANDLE for the WordPress REST-API
≤2.0No patch available
- High7.3Unauthenticated Privilege Escalation
Userplace – Member Subscription, Restriction & Payments
≤1.2.0No patch available
- Medium4.3Missing Authorization
Sync Post With Other Site
≤1.9.3Update to 1.9.4
- Medium5.3Unauthenticated Persistent Unauthorized Account Access
JWT Auth – WordPress JSON Web Token Authentication
≤3.0.2No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
Razorpay for WooCommerce
≤4.8.8Update to 4.8.9
- Medium5.3Missing Authorization
Razorpay for WooCommerce
≤4.8.8Update to 4.8.9
- Medium5.3Unauthenticated Information Exposure
Razorpay for WooCommerce
≤4.8.8Update to 4.8.9
- Medium4.3Authenticated (Subscriber+) Arbitrary Backup Directory Deletion
BackUpWordPress
≤3.14Update to 3.15
- High7.2Unauthenticated Stored Cross-Site Scripting
Turisbook Booking System
≤1.3.8No patch available
- Medium4.311.0.1 - Insecure Storage of Password
WooCommerce Stripe Payment Gateway
10.9.0 – 11.0.1Update to 11.1.0
- Medium5.31.5.9 - Unauthenticated Payment Bypass
Event Tickets Manager for WooCommerce
1.5.4 – 1.5.9Update to 1.6.0
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
WP BASE Booking of Appointments, Services and Events
≤6.5.0Update to 6.5.1
- Low2.7Missing Authorization
Post Duplicator
≤3.0.17Update to 3.0.18
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤4.3.5Update to 4.3.6
- Medium5.3Unauthenticated Information Exposure
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤5.1.0Update to 5.1.1
- Medium5.3Unauthenticated Information Exposure
Mail Debug for WooCommerce
≤1.3.0No patch available
- Critical9.80.4.7 - Unauthenticated Remote Code Execution
Confection WordPress Cable
0.4.0 – 0.4.7No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
mView 豆瓣电影
≤1.0.3No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Write
AZEXO Store Locator
≤1.4No patch available
- High7.5Unauthenticated SQL Injection
Productive Commerce – Wishlist, Compare & MiniCart
≤1.1.53Update to 1.1.54
- Critical9.8Unauthenticated Account Takeover visa Brute Force
Ecommerce Affiliate
≤1.0.0No patch available
- Medium5.31.12.1 - Missing Authorization
FraudLabs Pro SMS Verification
1.11.2 – 1.12.1No patch available
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Feed Item Title
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.13Update to 5.2.14
- Medium6.5Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.2Update to 3.6.3
- Critical9.1Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter
ELEX WordPress HelpDesk & Customer Ticketing System
≤3.3.8Update to 3.3.9
- High7.5Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize()
WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database
≤1.8.0Update to 1.8.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
WP Customer Area
≤8.4.0Update to 8.4.1