Sensitive data exposure in WordPress plugins
Sensitive data exposure means the plugin shows information to someone who should not see it. Examples: form submissions readable by anyone, user email addresses in a public API response, debug logs or backup files left in a public folder, or private posts visible to subscribers.
On its own this does not let anyone take over the site, but the leaked data can be personal (which may trigger privacy obligations) or useful for a later attack, such as admin usernames or API keys.
What to do: update the plugin. If the record mentions log or export files, check the plugin’s folder under wp-content/uploads for files that should not be public and delete them. If it leaked keys or passwords, change them.
Worried a plugin bug was used on your site?
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Newest Sensitive data exposure records
975 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
-
medium 6.5 Dynific Addons for Elementor (formerly Anywher…
Information disclosure
-
medium 5.9 affects latest 1.5.3 WP Fastest Cache
Information disclosure
-
medium 4.3 Kali Forms
Information disclosure
-
medium 5.3 All in One SEO
Information disclosure
-
medium 5.3 Booking for Appointments and Events Calendar
Information disclosure
-
medium 5.9 WP Data Access
Information disclosure
-
medium 5.3 Seraphinite Accelerator
Information disclosure
-
high 7.5 Mail logging & Catcher
Information disclosure
-
medium 5.3 PDF Invoices & Packing Slips for WooCommerce
Information disclosure
-
medium 5.3 All-in-One Video Gallery
Information disclosure
-
medium 5.3 Quick Event Manager
Information disclosure
-
medium 4.9 Payment Forms for Paystack
Information disclosure
-
high 7.5 Flexible Chat
Information disclosure
-
medium 6.5 HUSKY
Information disclosure
-
high 7.5 Advanced Custom Fields
Information disclosure
-
medium 5.3 BuddyForms
Information disclosure
-
medium 4.4 Security Plugin, Firewall & Malware Scanner wi…
Information disclosure
-
medium 5.3 Document Library Lite
Information disclosure
-
high 7.5 affects latest 2.2.2 WP Crowdfunding
Information disclosure
-
medium 5.3 MW WP Form
Information disclosure
-
medium 5.3 Everest Forms
Information disclosure
-
medium 5.3 Link Library
Information disclosure
-
medium 5.3 Recipe Card Blocks Lite
Information disclosure
-
medium 5.3 GeoDirectory
Information disclosure
-
low 3.7 WP Post Author
Information disclosure
-
high 7.5 Contact Form by Supsystic
Information disclosure
-
medium 4.3 Related Posts for WordPress
Information disclosure
-
medium 4.3 Related Posts for WordPress
Information disclosure
-
low 2.7 GeoDirectory
Information disclosure
-
medium 5.3 Essential Addons for Elementor
Information disclosure
-
medium 6.5 PayPlug for WooCommerce (Official)
Information disclosure
-
medium 5.3 Royal Addons for Elementor
Information disclosure
-
low 2.7 Page Builder by SiteOrigin
Information disclosure
-
high 7.5 Animated Text Block
Information disclosure
-
medium 6.5 Media Library Assistant
Information disclosure
-
medium 5.9 LiteSpeed Cache
Information disclosure
-
medium 5.3 GeoDirectory
Information disclosure
-
medium 5.3 GeoDirectory
Information disclosure
-
medium 5.3 Otter Blocks
Information disclosure
-
medium 5.3 Otter Blocks
Information disclosure
-
medium 5.3 ShopMagic
Information disclosure
-
medium 5.9 WholesaleX
Information disclosure
-
medium 5.3 SureCart
Information disclosure
-
medium 5.3 Booking Package
Information disclosure
-
medium 4.3 Easy Property Listings
Information disclosure
-
medium 5.3 Easy Property Listings
Information disclosure
-
medium 4.3 Modern Events Calendar Lite
Information disclosure
-
high 7.5 Gantry 5 Framework
Information disclosure
-
medium 6.5 ThirstyAffiliates
Information disclosure
-
medium 5.3 PeachPay
Information disclosure
-
medium 6.5 WP Booking System
Information disclosure
-
low 3.7 Appointment Booking Plugin
Information disclosure
-
medium 5.3 Document Gallery
Information disclosure
-
medium 6.5 Subscribe to Comments
Information disclosure
-
low 2.7 Product Delivery Date for WooCommerce
Information disclosure
-
medium 4.3 Salon Booking System
Information disclosure
-
low 2.7 WP Mail Logging
Information disclosure
-
medium 6.5 WSP MCP
Information disclosure
-
medium 5.3 HUSKY
Information disclosure
-
medium 4.3 Image Hub
Information disclosure
-
high 7.5 Modula Image Gallery
Information disclosure
-
medium 6.5 Forminator Forms
Information disclosure
-
medium 6.5 Infinite Uploads
Information disclosure
-
high 7.5 FluentCart
Information disclosure
-
medium 4.3 Elementor Website Builder
Information disclosure
-
medium 4.3 Appointment Booking Plugin
Information disclosure
-
medium 5.3 AWP Classifieds
Information disclosure
-
medium 4.3 Tainacan
Information disclosure
-
medium 5.3 GamiPress
Information disclosure
-
medium 5.3 WP Data Access
Information disclosure
-
medium 5.3 Active Woot Products Tables for WooCommerce. 1…
Information disclosure
-
medium 4.3 Ad Inserter
Information disclosure
-
medium 4.7 Simple Membership
Information disclosure
-
low 2.7 Envira Gallery
Information disclosure
-
medium 5.3 YITH WooCommerce Product Add-Ons
Information disclosure
-
high 7.5 affects latest 5.0.7 DTX
Information disclosure
-
medium 5.9 affects latest 1.4.0 Swish Migrate and Backup
Information disclosure
-
high 7.5 Web Plura Backup & Restore
Information disclosure
-
medium 5.9 WP Rollback
Information disclosure
-
low 3.7 SpeedyCache
Information disclosure
-
medium 5.3 Order Export & Order Import for WooCommerce
Information disclosure
-
medium 5.3 Booking Calendar
Information disclosure
-
medium 5.3 Booking Package
Information disclosure
-
medium 5.3 Accept PayPal Payments using Contact Form 7
Information disclosure
-
medium 4.3 Download Manager
Information disclosure
-
medium 5.3 Online Scheduling and Appointment Booking System
Information disclosure
-
medium 6.9 QA Assistants
Information disclosure
-
medium 4.3 All Bootstrap Blocks
Information disclosure
-
medium 5.3 SendPress Newsletters
Information disclosure
-
low 2.7 SMS Alert
Information disclosure
-
medium 4.3 Wallet System for WooCommerce
Information disclosure
-
medium 5.9 BackWPup
Information disclosure
-
low 2.7 Booking Calendar
Information disclosure
-
medium 4.3 Easy Digital Downloads
Information disclosure
-
medium 4.3 User Private Files
Information disclosure
-
high 7.5 Norvis Backup
Information disclosure
-
high 7.5 Snapshotify
Information disclosure
-
high 7.5 Museder RestoreOne
Information disclosure
-
high 7.5 SafeSnap
Information disclosure
-
medium 5.3 Mailjet Email Marketing
Information disclosure
Other types
Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · PHP object injection · Privilege escalation · Remote code execution · Arbitrary file upload · Path traversal and file read · Authentication bypass · File inclusion · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Denial of service · Content injection
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.