CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 4)
Debug logs, backups and exports left reachable without authentication.
- Medium5.3Missing Authorization
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1235Update to 4.1236
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤10.0.3Update to 10.0.4
- Medium4.3Missing Authorization
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.7.2Update to 2.8.0
- Medium5.3Missing Authorization
Restrict User Access – Ultimate Membership & Content Protection
≤2.8.3Update to 2.8.4
- Medium4.3Missing Authorization
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.51.0Update to 3.51.3
- Medium5.3Unauthenticated Information Exposure
Security For WooCommerce
≤1.0.16No patch available
- Medium5.3Missing Authorization
Security For WooCommerce
≤1.0.16No patch available
- Medium5.3Missing Authorization
Security For WooCommerce
≤1.0.16No patch available
- Medium4.34.17.3 - Missing Authorization
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
4.16.13 – 4.17.3Update to 4.17.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Display Eventbrite Events
≤6.9.1Update to 6.9.2
- Medium4.3Missing Authorization
E2Pdf – Export Pdf Tool for WordPress
≤1.32.65Update to 2.00.00
- Medium5.3Missing Authorization
Event Tickets and Registration
<5.30.3.1Update to 5.30.3.1
- Medium5.3Missing Authorization
Redirection for Contact Form 7
<3.2.16Update to 3.2.16
- Medium4.3Cross-Site Request Forgery
VISeek – Easy Custom Search
≤1.0.5Update to 1.0.6
- Medium4.3Cross-Site Request Forgery
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
<6.0.8Update to 6.0.8
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Schema & Structured Data for WP & AMP
<1.70Update to 1.70
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Directory Kit
<1.6.3Update to 1.6.3
- Medium4.3Authenticated (Contributor+) Information Exposure
Dynific Addons for Elementor (formerly Anywhere Elementor)
<1.3.1Update to 1.3.1
- Medium5.3Missing Authorization
Restrict User Access – Ultimate Membership & Content Protection
≤2.8.3Update to 2.8.4
- High7.3Unauthenticated Privilege Escalation
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.58.4Update to 1.58.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
Author Image
≤4.9.3No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation to Missing Capability and Nonce Check in process_reset()
Reset Database
≤1.1.3No patch available
- High8.8Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'six_storage_online_api_url' Option Poisoning + Transient-Backed Auth Bypass
6Storage Rentals
≤2.31.0No patch available
- Medium6.1Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable
Joinchat – Enhanced “click to chat”
≤6.3.1Update to 6.3.2
- High8.1Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header
ARforms
≤7.2.4Update to 7.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Referer Header
ARforms
≤7.2.4Update to 7.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'description' Parameter
ARforms
≤7.2.4Update to 7.3
- Medium6.1Reflected Cross-Site Scripting via 'text_no_products' Parameter
Product Filter for WooCommerce by WBW
≤3.4.5Update to 3.4.6
- Critical9.8Unauthenticated Authentication Bypass via Forged Opauth Callback Signature with Hardcoded Fallback Salt
Basel Post Types
≤1.18Update to 1.19
- High7.5Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.3No patch available