WordPress plugin
Featured Image from URL (FIFU) security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High4
- Medium13
- Low0
All Featured Image from URL (FIFU) vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤6.1.4Update to 6.1.5 | CVE-2026-123476 | |
| Medium4.3 | Cross-Site Request Forgery ≤6.0.7Update to 6.0.8 | CVE-2026-96671 | |
| High8.8 | Cross-Site Request Forgery ≤6.0.7Update to 6.0.8 | CVE-2026-101147 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-site Scripting ≤5.3.3Update to 6.0.0 | CVE-2026-73340 | |
| Medium4.3 | Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url' ≤5.3.1Update to 5.3.2 | CVE-2025-13393 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields ≤5.2.7Update to 5.2.8 | CVE-2025-7400 | |
| Medium5.3 | Missing Authorization to Password Protected Post Disclosure ≤5.2.7Update to 5.2.8 | CVE-2025-9984 | |
| Medium4.9 | Authenticated (Admin+) SQL Injection ≤5.2.7Update to 5.2.8 | CVE-2025-10037 | |
| Medium4.9 | Authenticated (Admin+) SQL Injection ≤5.2.7Update to 5.2.8 | CVE-2025-10036 | |
| Medium5.3 | Unauthenticated Information Exposure via Log File ≤5.2.7Update to 5.2.8 | CVE-2025-9985 | |
| Medium4.3 | Missing Authorization ≤4.8.2Update to 4.8.3 | CVE-2024-37516 | |
| Medium5.3 | Missing Authorization ≤4.8.1Update to 4.8.2 | CVE-2024-37276 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url ≤4.6.2Update to 4.6.3 | CVE-2024-1496 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt text ≤4.5.3Update to 4.5.4 | CVE-2023-6561 | |
| Medium5.5 | Stored Cross-Site Scripting ≤4.0.0Update to 4.0.1 | CVE-2022-2278 | |
| High8.8 | Cross-Site Request Forgery ≤3.9.9Update to 4.0.0 | CVE-2022-2241 | |
| High7.3 | Missing Authorization on REST API routes ≤2.7.7Update to 2.7.8 | — |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.1.4Update to 6.1.5
- Medium4.3Cross-Site Request Forgery
≤6.0.7Update to 6.0.8
- High8.8Cross-Site Request Forgery
≤6.0.7Update to 6.0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-site Scripting
≤5.3.3Update to 6.0.0
- Medium4.3Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url'
≤5.3.1Update to 5.3.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields
≤5.2.7Update to 5.2.8
- Medium5.3Missing Authorization to Password Protected Post Disclosure
≤5.2.7Update to 5.2.8
- Medium4.9Authenticated (Admin+) SQL Injection
≤5.2.7Update to 5.2.8
- Medium4.9Authenticated (Admin+) SQL Injection
≤5.2.7Update to 5.2.8
- Medium5.3Unauthenticated Information Exposure via Log File
≤5.2.7Update to 5.2.8
- Medium4.3Missing Authorization
≤4.8.2Update to 4.8.3
- Medium5.3Missing Authorization
≤4.8.1Update to 4.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url
≤4.6.2Update to 4.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt text
≤4.5.3Update to 4.5.4
- Medium5.5Stored Cross-Site Scripting
≤4.0.0Update to 4.0.1
- High8.8Cross-Site Request Forgery
≤3.9.9Update to 4.0.0
- High7.3Missing Authorization on REST API routes
≤2.7.7Update to 2.7.8
Featured Image from URL (FIFU): common questions
Does Featured Image from URL (FIFU) have known vulnerabilities?
Yes. VulnCrest Radar lists 17 known vulnerabilities in Featured Image from URL (FIFU): 4 high, 13 medium. None are known to affect version null.
How do I check which version of Featured Image from URL (FIFU) I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Featured Image from URL (FIFU) vulnerability?
CVE-2026-123476, published Nov 7, 2026: Featured Image from URL (FIFU) <= 6.1.4 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any Featured Image from URL (FIFU) vulnerability listed in CISA KEV?
No. None of the known Featured Image from URL (FIFU) vulnerabilities is currently listed in the CISA KEV catalog.