CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 8)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder
≤4.0.1Update to 4.0.2
- Medium5.3Missing Authorization
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤3.3.0Update to 3.3.1
- Medium4.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.12.0Update to 2.12.1
- Medium4.3Missing Authorization
Media Library Assistant
≤3.43Update to 3.44
- Medium4.3Cross-Site Request Forgery
Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox
≤1.21.6Update to 1.21.7
- Medium4.3Missing Authorization
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.3Update to 4.3.4
- Medium5.3Missing Authorization
MoreConvert Wishlist for WooCommerce
≤2.0.3Update to 2.0.4
- Medium5.3Missing Authorization
Premium Blocks – Gutenberg Blocks, Patterns & Templates
≤2.3.18Update to 2.3.19
- Medium4.3Missing Authorization
Dynific Addons for Elementor (formerly Anywhere Elementor)
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MoreConvert Wishlist for WooCommerce
≤2.0.3Update to 2.0.4
- Medium5.3Missing Authorization
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution
≤2.5.0Update to 2.6.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Recipe Maker
≤10.9.1Update to 10.9.2
- Medium4.3Missing Authorization
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.3Update to 3.8.4
- Medium6.4Authenticated (Vendor+) Stored Cross-Site Scripting
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.3Update to 3.8.4
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3
- Medium4.3Cross-Site Request Forgery
Wp Social Login and Register Social Counter
≤3.2.3Update to 3.2.4
- Medium4.3Missing Authorization
VOD Infomaniak
≤1.5.15Update to 1.5.16
- Medium5.3Missing Authorization
WP-Lister Lite for Amazon
≤2.9.2Update to 2.9.2.5
- Medium5.3Unauthenticated Information Exposure
YITH WooCommerce Subscription
≤4.22.0Update to 4.23.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter
Subscribe2 – Form, Email Subscribers & Newsletters
≤10.47Update to 10.48
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter
Flipbox – Awesomes Flip Boxes Image Overlay
≤3.1.1Update to 3.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attribute
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.5Update to 2.1.6
- Medium4.3Cross-Site Request Forgery
Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More
≤4.2.4Update to 4.2.5
- Medium6.1Reflected Cross-Site Scripting
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO
≤3.1.4Update to 3.1.5
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.12Update to 4.4.13
- High7.3Unauthenticated Arbitrary Shortcode Execution
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.7Update to 4.18.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
JetFormBuilder – Hierarchical Select
≤1.0.10Update to 1.0.11
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1