WordPress plugin
Featured Image from URL (FIFU) security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High4
- Medium13
- Low0
All Featured Image from URL (FIFU) vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤6.1.4Update to 6.1.5 | CVE-2026-123476 | |
| High8.8 | Cross-Site Request Forgery ≤6.0.7Update to 6.0.8 | CVE-2026-101147 | |
| High8.8 | Cross-Site Request Forgery ≤3.9.9Update to 4.0.0 | CVE-2022-2241 | |
| High7.3 | Missing Authorization on REST API routes ≤2.7.7Update to 2.7.8 | — |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.1.4Update to 6.1.5
- High8.8Cross-Site Request Forgery
≤6.0.7Update to 6.0.8
- High8.8Cross-Site Request Forgery
≤3.9.9Update to 4.0.0
- High7.3Missing Authorization on REST API routes
≤2.7.7Update to 2.7.8
Featured Image from URL (FIFU): common questions
Does Featured Image from URL (FIFU) have known vulnerabilities?
Yes. VulnCrest Radar lists 17 known vulnerabilities in Featured Image from URL (FIFU): 4 high, 13 medium. None are known to affect version null.
How do I check which version of Featured Image from URL (FIFU) I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Featured Image from URL (FIFU) vulnerability?
CVE-2026-123476, published Nov 7, 2026: Featured Image from URL (FIFU) <= 6.1.4 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any Featured Image from URL (FIFU) vulnerability listed in CISA KEV?
No. None of the known Featured Image from URL (FIFU) vulnerabilities is currently listed in the CISA KEV catalog.