CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 47)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
YITH WooCommerce Wishlist
≤4.18.1Update to 4.19.0
- High7.5Authenticated (Contributor+) PHP Object Injection
Team Members – Team Showcase, Team Slider, Grid, Table & Staff Directory
≤2.8.2Update to 2.8.3
- High7.5Authenticated (Contributor+) PHP Object Injection
GS Pinterest Portfolio – Pinterest Feed, Pinterest Board & Pin Widgets
≤1.9.2Update to 1.9.3
- Medium6.1Reflected Cross-Site Scripting
Live Summary for Gravity Forms
≤1.2.10Update to 1.2.11
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.5Update to 3.15.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Strong Testimonials
≤3.3.12Update to 3.3.13
- Medium5.3Unauthenticated Information Exposure
WholesaleX – Wholesale Pricing & B2B Solution
≤3.0.8Update to 3.0.9
- High8.8Authenticated (Subscriber+) Arbitrary PHP Code Execution
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.5Update to 6.2.0
- Medium5.3Unauthenticated Abandoned Cart Takeover
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails
<2.2.0Update to 2.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Jane Menu
≤1.5.0Update to 1.5.1
- Medium5.8Unauthenticated HTML Injection
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
<1.26.15Update to 1.26.15
- Medium4.3Missing Authorization
Sensei LMS – Online Courses, Quizzes, & Learning
≤4.26.3Update to 4.26.4
- Medium5.3Missing Authorization
SUMIT Payment Gateway for WooCommerce
<4.0.0Update to 4.0.0
- Medium5.3Unauthenticated Account Activation Bypass
WholesaleX – Wholesale Pricing & B2B Solution
<3.0.9Update to 3.0.9
- Medium5.3Unauthenticated Information Exposure
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
- Medium5.3Unauthenticated Insecure Direct Object Reference
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.3Update to 1.23.4
- Medium4.3Missing Authorization
Backup and Staging by WP Time Capsule
≤1.22.27Update to 1.22.28
- High8.8Cross-Site Request Forgery
Uncanny Toolkit for LearnDash
<3.8.2Update to 3.8.2
- Medium5.31.1.2 - Unauthenticated Information Exposure
Click n Chat (Chat Widget Integration)
1.0.4 – 1.1.2Update to 1.1.3
- High7.51.1.2 - Unauthenticated SQL Injection
Click n Chat (Chat Widget Integration)
1.0.4 – 1.1.2Update to 1.1.3
- High7.5Unauthenticated SQL Injection
Click n Chat (Chat Widget Integration)
≤1.1.2Update to 1.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Translate WordPress with Weglot 2.0 – Multilingual AI Translation
≤6.4.2Update to 6.4.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.4Update to 4.3.5
- Medium5.3Missing Authorization
TI WooCommerce Wishlist
≤2.12.0Update to 2.13.0
- High7.32.9.25 - Unauthenticated Privilege Escalation
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
2.9.21 – 2.9.25Update to 2.9.26
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Pricing Table WordPress Plugin – Easy Pricing Tables
≤4.1.2Update to 4.1.3
- Low2.7Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.5Update to 3.8.6
- Medium4.3Missing Authorization
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.3Update to 1.23.4
- Medium5.3Missing Authorization
Booking Package
≤1.7.30Update to 1.7.31
- Medium5.3Missing Authorization
Escape Room Booking Pro
≤1.3.0Update to 1.3.1