CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 103)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.7Unauthenticated Open Redirect
Safe Redirect Manager
≤2.2.0Update to 2.3.0
- High7.5Authenticated (Author+) PHP Object Injection
Minimum and Maximum Quantity for WooCommerce
≤2.1.2Update to 2.1.3
- Medium5.3Unauthenticated Unauthorized Subscription Activation
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.9Update to 3.1.0
- High8.1Unauthenticated PHP Object Injection
Booking Activities
≤1.18.7.1Update to 1.18.8
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Content Egg – Affiliate Product Importer & Price Comparison
≤6.3.1Update to 11.9.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Trusted Shops Easy Integration for WooCommerce
≤2.0.6Update to 2.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.3Update to 6.1.5
- High7.5Authenticated (Custom Role+) PHP Object Injection
eCommerce Product Catalog
≤3.6.0Update to 3.6.1
- High7.5Authenticated (Custom Role+) PHP Object Injection
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.9Update to 1.17.10
- High7.5Authenticated (Contributor+) PHP Object Injection
DesignSetGo
≤2.8.0Update to 2.8.1
- Medium5.3Missing Authorization
GravityExport Lite for Gravity Forms
≤2.7.2Update to 2.7.3
- Medium5.31.9.7 - Missing Authorization
InPost PL
1.7.5 – 1.9.7Update to 1.9.8
- Medium6.12.8.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Mobile Menu – The Mobile-Friendly Responsive Menu
2.7.4 – 2.8.8Update to 2.9
- High7.58.7.7 - Authenticated (Author+) PHP Object Injection
EWWW Image Optimizer
8.6.0 – 8.7.7Update to 8.8.0
- Medium5.32.0.6 - Unauthenticated Access Mode Bypass
WPEPP – All In One WordPress Security, Firewall, Malware Scanner & Login Protection
2.0.0 – 2.0.6Update to 2.0.7
- Medium4.3Missing Authorization
Vayu X
≤1.0.5Update to 1.0.6
- Medium5.3Unauthenticated Information Exposure
Connections Business Directory
≤10.4.67No patch available
- High7.22.0.16 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
All in One Files Upload for WooCommerce
2.0.3 – 2.0.16Update to 2.0.17
- Medium5.33.2.9 - Unauthenticated Information Exposure
New User Approve
3.1.0 – 3.2.9Update to 3.2.10
- Medium5.3Unauthenticated Information Exposure
Solace Extra
≤1.7.1Update to 1.7.2
- Medium4.3Authenticated (Subscriber+) Subscription-Gated Post Creation
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium5.34.3.11 - Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
2.5.8 – 4.3.11Update to 4.3.12
- Medium4.7Cross-Site Scripting to Unauthenticated Arbitrary HTML Content Injection in Admin Log
WP Mail Logging
≤1.16.0Update to 1.17.0
- High7.3Unauthenticated Unauthorized Customer Account Access
FluentCart – Online Store Builder & eCommerce Checkout
≤1.6.4Update to 1.6.5
- Medium5.32.0.5 - Unauthenticated Arbitrary Payment Amount Reduction
Easy PayPal & Stripe Buy Now Button
1.8 – 2.0.5Update to 2.0.6
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Schema & Structured Data for WP & AMP
≤1.66Update to 1.67
- High7.22.0.0 - Unauthenticated Server-Side Request Forgery
Broken Link Notifier
1.3.1 – 2.0.0Update to 2.0.0.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
YITH WooCommerce Tab Manager
≤2.15.0Update to 2.15.1
- Medium5.3Unauthenticated Information Exposure
Course Booking System
≤7.0.8Update to 7.0.9
- High7.5Authenticated (Contributor+) PHP Object Injection
Themify Builder
≤7.8.1Update to 7.8.2