CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 120)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.9Update to 5.6.10
- Medium4.9Authenticated (Administrator+) SQL Injection
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
≤2.7.2.1Update to 2.7.2.2
- Medium5.4Authenticated (Custom+) Missing Authorization to Limited Account Takeover
Booking for Appointments and Events Calendar – Amelia
≤2.4.4Update to 2.4.5
- Medium5.3Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
Booking for Appointments and Events Calendar – Amelia
≤2.4.5Update to 2.4.6
- Medium4.9Authenticated (Editor+) SQL Injection
SKT Addons for Elementor
≤4.0Update to 4.1
- Medium4.9Authenticated (Shop Manager+) SQL Injection
WP-Lister Lite for eBay
≤3.8.11Update to 3.8.12
- Medium4.9Authenticated (Administrator+) SQL Injection
Issues and Series for Newspapers, Magazines, Publishers, Writers
≤3.1.3Update to 3.1.4
- Medium4.9Authenticated (Administrator+) SQL Injection
MoreConvert Wishlist for WooCommerce
≤1.9.21Update to 2.0.0
- Medium5.3Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
Motors – Car Dealership & Classified Listings Plugin
≤1.4.120Update to 1.4.121
- Medium5.32.1.6 - Unauthenticated Information Exposure
MgoSync – European dropshipping and suppliers
2.1.5 – 2.1.6Update to 2.1.7
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags
Auto Upload Images
≤3.3.2Update to 3.4.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
≤2.8.0Update to 2.9.0
- Medium5.3Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
≤2.34.6Update to 2.34.7
- Medium5.3Missing Authorization
Botiga Pro
≤1.6.4Update to 1.6.5
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via Media Import
Use-your-Drive | Google Drive plugin for WordPress
2.0 – 3.8.3Update to 3.9.0
- Medium5.3Missing Authorization
Mailchimp for WooCommerce
≤6.1.0Update to 6.1.1
- Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.2.3Update to 1.2.4
- Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.2.2Update to 1.2.3
- Medium5.3Unauthenticated Payment Bypass
Payment Gateway for PayPal on WooCommerce
≤9.2.0Update to 9.2.1
- Medium5.3Missing Authorization
WPGraphQL Smart Cache
≤2.3.1Update to 2.3.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.1Update to 28.2
- Medium4.3Missing Authorization
Checkout Field Manager (Checkout Manager) for WooCommerce
≤7.9.6Update to 7.9.7
- High7.3Social Login <= 1.5.9 - Unauthenticated Privilege Escalation
UsersWP – Social Login
≤1.5.9Update to 1.5.10
- High7.2Unauthenticated Stored Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.0Update to 2.13.1
- Medium4.3Missing Authorization
Unbounce Landing Pages
≤1.1.4Update to 1.1.5
- Critical9.83.5.50 - Unauthenticated Arbitrary File Upload
Ultra Addons for Contact Form 7
3.2.4 – 3.5.50Update to 3.5.51
- Medium6.1Reflected Cross-Site Scripting
Estatik Real Estate Plugin
≤4.3.4Update to 4.3.5
- Medium4.7Authenticated (Admin+) Privilege Escalation
WP Import Export Lite
≤3.9.34Update to 3.9.35
- Medium6.5Authenticated (Administrator+) Arbitrary File Deletion
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.5.2Update to 3.6.5.3
- High7.2Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling
WordPress
≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1