CWE-200Vulnerability type
WordPress Information Exposure vulnerabilities (page 95)
Debug logs, backups and exports left reachable without authentication.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- High7.5Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
SiteOrigin Widgets Bundle
≤1.73.2Update to 1.74.0
- Critical9.1Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- Critical9.8Unauthenticated Authentication Bypass via 'paypal_param' Parameter
Divi Membership
≤2.3.0Update to 3.0.0
- Critical9.8Unauthenticated Privilege Escalation via 'form_id' Parameter
Divi Membership
≤2.2.0Update to 2.3.0
- High7.2Authenticated (Administrator+) Remote Code Execution
CTX Feed Pro
≤7.6.12No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)
Visitor Traffic Real Time Statistics pro
≤11.22Update to 11.23
- Critical9.8Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow
DevKit Pro
≤2.3.0Update to 2.3.1
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.1Update to 2.14.0
- Medium6.1Reflected Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Critical9.8Unauthenticated Remote Code Execution
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
ByteCoreStack – MCP Connector for AI Tools
≤1.2.2Update to 1.2.4
- High7.3Unauthenticated Privilege Escalation
Authorizer
≤3.15.3Update to 3.16.0
- Medium4.3Missing Authorization
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
≤4.0.7Update to 4.1.0
- Medium4.3Missing Authorization
Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more
≤3.6.2Update to 3.7.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Bus Ticket Booking with Seat Reservation
≤5.9.3Update to 5.9.4
- Medium4.3Missing Authorization
Aruba Migration Tool
≤1.0.4Update to 1.0.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Premmerce Wishlist for WooCommerce
≤1.1.13Update to 1.1.15
- Medium5.3Unauthenticated Information Exposure
CF7 Apps – Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.)
≤3.7.2Update to 3.8.0
- Medium4.9Authenticated (Editor+) SQL Injection
Captivate Sync
≤3.3.2Update to 3.3.3
- Medium4.9Authenticated (Administrator+) SQL Injection
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.1Update to 2.14.0
- Medium4.3Missing Authorization
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.1Update to 2.3.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
ProfileGrid – User Profiles, Groups and Communities
≤6.0.0.2Update to 6.0.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.8.4Update to 6.8.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.0Update to 4.3.1
- Medium5.3Unauthenticated Information Exposure
Pie Register – User Registration, Profiles & Content Restriction
≤3.8.4.13Update to 3.8.4.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤4.0.6Update to 4.0.7
- Medium6.5Authenticated (Contributor+) SQL Injection
BuildKit – Product Builder for WooCommerce – Custom PC Builder
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤4.0.6Update to 4.0.7
- Medium5.3Missing Authorization
AFFI – Affiliate Marketing for WooCommerce
≤1.0.9Update to 1.0.10