CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 91)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
≤3.0.19Update to 3.0.20
- Critical9.1Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
VikAppointments Services Booking Calendar
≤1.2.21Update to 1.2.22
- High8.8Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter
Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)
≤8.97.0Update to 8.98.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Responsive Starter Templates – Elementor Templates & Starter Sites
≤3.5.3Update to 3.5.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
Wp Social Login and Register Social Counter
≤3.2.1Update to 3.2.2
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter
SEOPress – AI SEO Plugin & On-site SEO
≤10.2Update to 10.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Author Display Name
SEOPress – AI SEO Plugin & On-site SEO
≤10.2Update to 10.3
- Medium6.1Reflected Cross-Site Scripting via 'woosq-redirect' Parameter
WPC Smart Quick View for WooCommerce
≤4.4.0Update to 4.4.1
- High8.1Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter
Revopic – Photo Reviews for WooCommerce
≤1.2.30Update to 1.2.31
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)
Rich Showcase for Google Reviews
≤7.1.3Update to 7.1.4
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header
Visitor Traffic Real Time Statistics
≤8.16Update to 8.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget
Ultra Addons Lite for Elementor
≤1.3.2Update to 1.3.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
Welcart e-Commerce
≤2.12.2Update to 2.12.3
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter
Helpdesk Support Ticket System for WooCommerce
≤2.1.6Update to 2.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field
Strong Testimonials
≤3.3.11Update to 3.3.12
- Medium5.3Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…
WPZOOM Connect: Social Icons Widget & Block, Share Buttons & Click to Chat
≤4.7.3Update to 4.7.4
- High7.5Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints
Simple Membership
≤4.8.3Update to 4.8.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder
Transliterator – Multilingual and Multi-script Text Conversion
≤2.5.8Update to 2.5.9
- High7.2Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author
Magic Tooltips For Contact Form 7
≤1.0.34Update to 1.0.35
- High7.5Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.186Update to 2.8.187
- Medium6.1Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.1.5Update to 5.5.1.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action
Alt Text AI – Automatically generate image alt text for SEO and accessibility
≤1.10.41Update to 1.10.42
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤5.0.2Update to 5.0.2.1
- Medium4.3Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤4.0.1Update to 4.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment
Real Cookie Banner: GDPR & ePrivacy Cookie Consent
≤5.3.5Update to 5.3.6
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Medium4.3Authenticated (Subscriber+) Information Exposure
Mindio Magic MCP
≤0.5.6Update to 0.7.1
- High8.8Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.9Update to 4.9.1
- Medium4.3Missing Authorization
WDS MCP Content Manager
≤3.10.4No patch available
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Issues and Series for Newspapers, Magazines, Publishers, Writers
≤3.1.3Update to 3.1.4