CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 114)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.310.8.1 - Unauthenticated Arbitrary User Meta Corruption
WP Recipe Maker
9.8.0 – 10.8.1Update to 10.8.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.9.4Update to 8.9.5
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.9.4Update to 8.9.5
- Medium4.38.9.4 - Missing Authorization
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.9.1 – 8.9.4Update to 8.9.5
- Medium5.38.9.4 - Unauthenticated Information Exposure
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.1 – 8.9.4Update to 8.9.5
- High8.8Authenticated (Subscriber+) Arbitrary User Identity Token Issuance to Privilege Escalation
WP OAuth Server ( Login with WordPress )
≤6.3.0Update to 6.4.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Payment Plugins for PayPal WooCommerce
≤2.0.26Update to 2.0.27
- Medium5.3Unauthenticated Payment Manipulation
Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More
≤2.3.3Update to 2.3.4
- Critical9.8Unauthenticated Remote Code Execution
YAHMAN Add-ons
≤0.9.30Update to 0.9.31
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.69Update to 3.1.70
- Medium5.37.5.1 - Unauthenticated Information Exposure
Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster
7.0.0 – 7.5.1Update to 7.5.2
- Medium5.3Unauthenticated Information Exposure
Post Grid Gutenberg Blocks – PostX
≤5.0.40Update to 5.0.41
- Medium4.310.8.1 - Authenticated (Subscriber+) Information Exposure
WP Recipe Maker
10.3.0 – 10.8.1Update to 10.8.2
- Medium6.3Authenticated (Subscriber+) HTML Injection
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Missing Authorization
Zportals
≤6.4.1Update to 6.4.2
- Medium5.3Unauthenticated Forged Payment and Subscription Events
Premium Packages – Sell Digital Products Securely
≤7.2.0Update to 7.2.1
- Medium4.3Missing Authorization
Points and Rewards for WooCommerce – Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification
≤2.10.3Update to 2.10.4
- Medium4.3Missing Authorization
WC Fields Factory
≤4.1.10Update to 4.1.11
- Medium6.41.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form
1.4.1 – 1.6.2Update to 1.6.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar
≤2.1.20Update to 2.1.21
- Medium6.5Authenticated (Author+) SQL Injection
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar
≤2.1.20Update to 2.1.21
- Medium5.3Unauthenticated Payment Bypass
Paymob for WooCommerce
≤4.1.13Update to 4.1.14
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Post Meta Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium4.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Ninja Tables – Responsive Table Builder for Data, Pricing & Product Tables
≤5.2.16Update to 5.2.17
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Translate WordPress with GTranslate
≤5.0.0Update to 5.0.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium4.36.17.4.1 - Missing Authorization
The Events Calendar
6.15.16.1 – 6.17.4.1Update to 6.17.5