CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 51)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.33.11.0 - Missing Authorization
Snap Finance
1.0.8 – 3.11.0Update to 3.12.0
- Medium5.31.2.9 - Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
1.1.9 – 1.2.9Update to 1.3.0
- High8.810.31.10 - Authenticated (Salon Staff+) Privilege Escalation
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
10.17 – 10.31.10Update to 10.31.11
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Blaze Demo Importer
≤1.0.16Update to 1.0.17
- Medium5.31.2.9 - Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
1.1.9 – 1.2.9Update to 1.3.0
- Medium5.3Unauthenticated Information Exposure
FormFlow for GoHighLevel (GHL) – Send Form Leads to GHL CRM
≤1.0.0Update to 1.0.1
- Low2.7Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.8Update to 3.7.9
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Modern Events Calendar Lite
≤7.36.3Update to 7.36.4
- Medium4.3Authenticated (Subscriber+) Information Exposure
Modern Events Calendar Lite
≤7.36.0Update to 7.37.0
- Medium5.3Unauthenticated Negative Booking Total Creation
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.10Update to 10.31.11
- Medium6.4Authenticated (Salon Staff+) Stored Cross-Site Scripting
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.10Update to 10.31.11
- High7.2Unauthenticated Stored Cross-Site Scripting
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.29Update to 1.0.30
- Medium5.3Missing Authorization
Gateway for Vantiv on WC
≤1.0.1No patch available
- Medium5.31.3.12 - Missing Authorization
BDM Digital Payment Gateway
1.2.7 – 1.3.12Update to 1.3.13
- Medium5.3Missing Authorization
ElementsReady Addons for Elementor
≤6.7.2No patch available
- Medium5.35.7.0 - Missing Authorization
App Builder – Create Native Android & iOS Apps On The Flight
3.8.4 – 5.7.0Update to 5.7.1
- Medium5.31.2.9 - Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
1.1.9 – 1.2.9Update to 1.3.0
- Medium4.3Missing Authorization
ElementsReady Addons for Elementor
≤6.7.2No patch available
- Medium5.3Unauthenticated Payment Bypass
iPOSpays Payment Gateway for WooCommerce
≤1.4.6Update to 1.4.7
- Critical9.8Unauthenticated Embedded Malicious Code
Rank Math SEO PRO
3.0.123 – 3.0.123Update to 3.0.124
- Medium6.1Reflected Cross-Site Scripting
WP Photo Album Plus
≤9.2.11.1Update to 9.2.11.002
- Low2.7Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.8Update to 3.7.9
- Medium4.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.10Update to 10.31.11
- Medium4.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.10Update to 10.31.11
- Medium4.31.2.10 - Missing Authorization
Tasty Recipes Lite – WordPress Recipe Card Plugin with Built-In Recipe Schema
1.2 – 1.2.10Update to 1.2.11
- Medium4.7Unauthenticated Open Redirect
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
≤3.2.2Update to 3.2.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
Fastcache by Host.it
≤1.7.5Update to 1.7.6
- Medium5.3Missing Authorization
ActiveTrail for WooCommerce
≤1.2.6Update to 1.2.7
- Medium5.3Missing Authorization
2Way VideoCalls and Random Chat – HTML5 Webcam Videochat
≤6.1.5Update to 6.1.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter
WP Sessions Time Monitoring Full Automatic
≤1.1.5Update to 1.1.6