CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 48)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Agent+) Insecure Direct Object Reference
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- Medium5.3Unauthenticated Payment Bypass
Simple Shopping Cart
≤5.3.2Update to 5.3.3
- Medium5.31.1.1 - Missing Authorization
Synchrony Financing
1.0.5 – 1.1.1Update to 1.1.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via mec_fes_csv_export
Modern Events Calendar
<7.37.0Update to 7.37.0
- Medium5.3Unauthenticated Payment Forgery
Snap Finance
<3.12.0Update to 3.12.0
- Medium5.30.3.9 - Missing Authorization
Wava Payment Plugin
0.3.1 – 0.3.9Update to 0.3.10
- Medium5.30.3.9 - Missing Authorization
Wava Payment Plugin
0.3.1 – 0.3.9Update to 0.3.10
- Medium4.3Missing Authorization
Sensei LMS – Online Courses, Quizzes, & Learning
≤4.26.3Update to 4.26.4
- Medium6.1Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.0Update to 4.0.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Kliken: Ads + Pixel for Meta
≤1.2.2Update to 1.2.3
- Medium6.5Authenticated (Author+) SQL Injection
Swift Performance Lite
≤2.3.7.3Update to 2.3.7.4
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
WPZOOM Portfolio Lite – Filterable Portfolio Plugin
≤1.4.33Update to 1.4.34
- Medium4.3Missing Authorization
Productive Commerce – Wishlist, Compare & MiniCart
≤1.1.48Update to 1.1.49
- Medium6.1Reflected Cross-Site Scripting
WP Booking System – Booking Calendar
≤2.1.0.2Update to 2.1.0.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
HireZoot – Job Listings, Career Page & Recruitment Tool
≤4.1.0Update to 4.1.1
- Low2.7Missing Authorization
Uncanny Toolkit for LearnDash
≤3.8.1Update to 3.8.2
- Medium4.3Missing Authorization
Moloni
≤5.0.13Update to 5.0.14
- Medium5.3Unauthenticated Information Exposure
Booking Package
≤1.7.30Update to 1.7.31
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Falang multilanguage for WordPress
≤1.4.5Update to 1.4.6
- Medium5.3Unauthenticated Payment Bypass
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- Medium4.35.3.2 - Authenticated (Contributor+) Payment Bypass
Simple Shopping Cart
5.1.3 – 5.3.2Update to 5.3.3
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
Payment Gateway for Idram
<2.1.6Update to 2.1.6
- Medium6.5Authenticated (Subscriber+) SQL Injection
Modern Events Calendar
<7.37.0Update to 7.37.0
- Medium4.3Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery
Download Manager
≤7.5.8Update to 3.3.71 or 7.5.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.4Update to 4.3.5
- Medium4.36.3.0 - Two-Factor Authentication Bypass
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
6.2.9 – 6.3.0Update to 6.3.1
- Critical9.1Unauthenticated Arbitrary File Deletion
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.6.28Update to 1.6.29
- High7.23.2.11 - Unauthenticated Stored Cross-Site Scripting
Redirection for Contact Form 7
2.2.7 – 3.2.11Update to 3.2.12
- High8.8Authenticated (Contributor+) Remote Code Execution
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Medium6.3Authenticated (Author+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.8.5Update to 6.8.6