CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 27)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Flexible Chat – AI chatbot plugin for WordPress and WooCommerce
≤1.1.0Update to 1.1.1
- Medium5.3Missing Authorization
WP REST Cache
≤2026.3.1Update to 2026.4.0
- High7.5Unauthenticated SQL Injection
Transliterator – Multilingual and Multi-script Text Conversion
≤2.5.13Update to 2.5.14
- High8.1Unauthenticated PHP Object Injection
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
≤3.8.6.1Update to 3.8.6.2
- Medium4.3Missing Authorization
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.8.2Update to 2.8.3
- Medium4.3Authenticated (Subscriber+) Arbitrary Media Attachment Deletion
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.7.1Update to 3.6.8
- High8.7Authenticated (Administrator+) Arbitrary Table Deletion
Database Cleaner: Cleanup, Optimization & Repair
≤1.4.7Update to 1.4.8
- Medium6.5Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters
Spectra Legacy – Gutenberg Blocks
≤2.20.4Update to 2.20.5
- Medium6.5Unauthenticated Arbitrary Shortcode Injection
GIFTiT – Free Gifts for WooCommerce
≤4.5Update to 4.6
- Medium5.4Authenticated (Contributor+) Cross-Site Scripting
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder
≤2.9.5Update to 2.9.6
- Medium6.53.8.11 - Unauthenticated Arbitrary Shortcode Execution
My Calendar – Accessible Event Manager
3.8.8 – <3.8.11Update to 3.8.11
- High8.1Unauthenticated PHP Object Injection
Royal Event | Catering & Wedding Chef Wordpress Theme
≤2.0No patch available
- High7.2Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.7.1Update to 3.6.8
- Medium5.3Unauthenticated Information Exposure
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
≤2.97.14Update to 2.97.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Library Assistant
≤3.43Update to 3.44
- Medium5.3Unauthenticated reCAPTCHA Validation Bypass
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.4Update to 6.2.5
- Low2.7Missing Authorization
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.4.0Update to 6.4.1
- Medium5.3Unauthenticated Non-Public Product Data Disclosure
YITH WooCommerce Product Add-Ons
≤4.34.0Update to 4.34.1
- Medium4.3Missing Authorization
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.29Update to 2.4.30
- Medium4.3Authenticated (Subscriber+) Information Exposure
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.29Update to 2.4.30
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
CF7 Mate – Contact Form 7 Styler, Multi-Step Forms & Conditional Logic
≤4.1.0Update to 4.1.1
- Medium5.3Unauthenticated Arbitrary Content Deletion
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤3.4.3Update to 3.5.0
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
SureDash – Community, Courses & Member Dashboard
≤1.12.3Update to 1.12.4
- Medium4.3Missing Authorization
Media Library Assistant
≤3.43Update to 3.44
- High8.8Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update
Ak Framework
≤2.9.8Update to 2.9.9
- High8.8Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.35Update to 7.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values
Gravity Forms
≤3.1.1Update to 3.1.2
- Critical9.8Unauthenticated PHP Object Injection via Post Custom Field
Gravity Forms
≤3.1.2Update to 3.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting via List Field
Gravity Forms
≤3.1.2Update to 3.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie
Food Store – Online Food Delivery & Pickup
≤1.5.5No patch available