CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 9)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
The Events Calendar
≤6.18.3Update to 6.18.3.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.6Update to 2.1.7
- Medium6.1Reflected Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.14Update to 7.3.15
- Medium5.3Missing Authorization
CURCY – Multi Currency for WooCommerce
≤2.2.20Update to 2.2.21
- Medium4.3Missing Authorization
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution
≤2.5.0Update to 2.6.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Cool FormKit Lite – Advanced Form Builder for Elementor
≤2.7.10Update to 2.7.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Post Fields for Contact Form 7
≤2.6.0Update to 2.7.1
- Medium5.3Missing Authorization
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
≤2.6.1Update to 2.6.2
- Medium4.3Missing Authorization
PowerPress Podcasting plugin by Blubrry
≤11.18.0Update to 11.18.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
≤3.21.2Update to 4.0.0
- Medium4.3Cross-Site Request Forgery
PowerPress Podcasting plugin by Blubrry
≤11.18.0Update to 11.18.2
- Medium4.3Authenticated (Subscriber+) Brute-Force Lockout Bypass
WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection
≤3.6.2Update to 3.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.26Update to 2.0.28
- High7.2Unauthenticated Stored Cross-Site Scripting
Invoice Gateway for WooCommerce – Invoice Payment Gateway
≤1.1.6Update to 1.1.7
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤3.3.0Update to 3.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.5Update to 4.3.6
- Medium4.3Missing Authorization
Meta Box – A Framework for Dynamic Websites
≤5.15.3Update to 5.15.4
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.3.1Update to 5.3.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤3.3.6Update to 3.3.7
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Welcart e-Commerce
≤2.12.6Update to 2.12.7
- Medium5.3Unauthenticated CAPTCHA Protection Bypass on Login
Simple CAPTCHA with Cloudflare Turnstile
≤1.44.4Update to 1.44.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Media Library Assistant
≤3.43Update to 3.44
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Site Reviews
≤8.3.6Update to 8.3.7
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.71Update to 3.1.72
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Customize WordPress Emails and Alerts – Better Notifications for WP
≤1.10.1Update to 1.10.2
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Exeuction
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.56Update to 3.7.57
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.7Update to 4.18.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]
Download Manager
6.0.0 – 7.5.9Update to 7.6.4
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action
Checkout Field Editor for WooCommerce (Pro)
≤3.8.0Update to 3.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent Header
Quttera ThreatSign – Web Malware Scanner for WordPress
≤4.1.0.48Update to 4.1.0.49