CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 16)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Insecure Direct Object Reference
Event Tickets Manager for WooCommerce
≤1.5.0Update to 1.6.0
- Medium5.3Unauthenticated Information Exposure
Pronamic Pay doneren met Mollie
≤11.0.0Update to 11.1.0
- Medium5.3Unauthenticated Information Exposure
WP Recipe Maker
≤10.9.1Update to 10.9.2
- High8.8Cross-Site Request Forgery to Administrator Account Creation
Komfortkasse for WooCommerce
≤1.4.8Update to 1.4.9
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
iLeads SMS Gateway by Exsile
≤1.0.0Update to 2.0.0
- Medium6.5Authenticated (Custom+) SQL Injection
Event Tickets with Ticket Scanner
≤3.2.8Update to 3.2.9
- Medium4.3Missing Authorization
Event Tickets with Ticket Scanner
≤3.1.13Update to 3.1.14
- High8.8Authenticated (Subscriber+) Privilege Escalation
Magic Link – Secure one click passwordless login
≤2.2.5Update to 2.2.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Add From Server Lite
≤5.0.0Update to 6.0.0
- Medium5.3Missing Authorization
Fiber Admin
≤4.0.0Update to 4.0.1
- Critical9.84.0.0 - Unauthenticated Remote Code Execution
Fiber Admin
3.1.0 – 4.0.0Update to 4.0.1
- Medium5.3Unauthenticated Information Exposure
Tournamatch
≤4.7.0Update to 4.7.1
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
Tournamatch
≤4.7.0Update to 4.7.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10Update to 8.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Live Composer – Free WordPress Website Builder
≤2.1.22Update to 2.1.23
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10Update to 8.11
- Medium4.3Authenticated (Subscriber+) Arbitrary Media Attachment Deletion
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10Update to 8.11
- Low2.7Missing Authorization
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10Update to 8.11
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10Update to 8.11
- Medium4.3Cross-Site Request Forgery
WP Google Review Slider
≤18.10Update to 18.11
- High7.2Unauthenticated Stored Cross-Site Scripting
FV Flowplayer Video Player
≤7.5.57.7211Update to 7.5.57.7212
- Critical9.86.2.3 - Unauthenticated Arbitrary File Upload
Contact Form 7
6.2 – 6.2.3Update to 6.2.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Live Composer – Free WordPress Website Builder
≤2.1.22Update to 2.1.23
- Medium5.3Unauthenticated Insecure Direct Object Reference
Antom Payments
≤2.0.11No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key
Redux Framework
≤4.5.16Update to 4.5.17
- High8.2Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching
LiteSpeed Cache
≤7.9.1Update to 7.9.2
- High8.1Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter
Motors – Car Dealership & Classified Listings Plugin
≤1.4.128Update to 1.4.129
- High8.8Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter
GiveWP – Donation Plugin and Fundraising Platform
≤4.19.1Update to 4.19.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute
Customer Reviews for WooCommerce
≤5.126.0Update to 5.127.0
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile
Redux Framework
≤4.5.16Update to 4.5.17