CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1234)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤5.17.2Update to 5.17.3
- Medium6.1Reflected Cross-Site Scripting
Booking Calendar
≤8.9.1Update to 8.9.2
- Medium6.1Reflected Cross-Site Scripting
Use-your-Drive | Google Drive plugin for WordPress
<1.18.3Update to 1.18.3
- Medium6.1Reflected Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤2.6.1Update to 2.6.2
- Medium6.1Reflected Cross-Site Scripting
UpdraftPlus Premium
<1.16.66Update to 1.16.66
- Medium6.1Chaty <= 2.8.2 Reflected Cross-Site Scripting
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
<2.8.3Update to 2.8.3
- Medium4.7Reflected Cross-Site Scripting
Share-one-Drive | OneDrive & SharePoint plugin for WordPress
<1.15.3Update to 1.15.3
- High8.8Remote File Inclusion leading to Remote Code Execution via Cross-Site Request Forgery
WP Coder – Insert & Manage Code Snippets
≤2.5.1Update to 2.5.2
- High8.8Cross-Site Request Forgery
Button Generator – Easily Create Custom Buttons with Icons and Analytics
≤2.3.2Update to 2.3.3
- High8.8Cross-Site Request Forgery to Remote Code Execution
Modal Window – create popup modal window
<5.2.2Update to 5.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Survey Maker by AYS
≤2.0.6Update to 2.0.7
- Medium5.4Subscriber+ Category Add Leading to Stored Cross-Site Scripting
Modern Events Calendar Lite
≤6.1.6Update to 6.2.0
- Medium5.4Cross-Site Scripting
Customize Login Image
≤3.4Update to 3.5
- High7.5Missing Authorization to Information Disclosure
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium4.3Missing Authorization on Option Changes
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium6.4Cross-Site Scripting
Post Duplicator
<2.24Update to 2.24
- Medium6.5Missing Authorization to Information Disclosure
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Variation Swatches for WooCommerce
≤2.1.1Update to 2.1.2
- Medium4.9Authenticated (Admin+) Arbitrary Folder Deletion via Path Traversal
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤4.5.11Update to 4.5.12
- Medium4.9Admin+ Arbitrary Folder Deletion via Path Traversal
CAOS | Host Google Analytics Locally
≤4.1.8Update to 4.1.9
- Medium5.5Editor+ Stored Cross-Site Scripting
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤5.3.0Update to 5.3.1
- Medium6.1Reflected Cross-Site Scripting in Product XML Feeds Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium6.1Reflected Cross-Site Scripting in PDF Invoicing Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium6.1Reflected Cross-Site Scripting in General Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium6.1Reflected Cross-Site Scripting via qc_res
LiteSpeed Cache
1.0.15 – 4.4.3Update to 4.4.4
- Medium6.5Authorization Bypass
LiteSpeed Cache
1.0.15 – 4.4.3Update to 4.4.4
- High8.8Cross-Site Request Forgery
Contact Form With Captcha
≤1.6.7Update to 1.6.8
- Medium6.1Reflected Cross-Site Scripting
MOLIE – Instructure Canvas Linking tool
≤0.5No patch available
- Medium6.4Cross-Site Scripting
Download Manager
<3.2.22Update to 3.2.22
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Typebot
<1.4.3Update to 1.4.3