CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1236)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Stored Cross-Site Scripting
Logo Carousel
<1.7.2Update to 1.7.2
- High7.2File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
Ninja Forms - File Uploads
≤3.3.12Update to 3.3.13
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Easy Registration Forms
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Preview E-mails for WooCommerce
≤1.6.8Update to 2.0.0
- Medium6.4Reflected Cross-Site Scripting
Child Theme Generator
≤2.2.7No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Backup Migration
≤1.1.5Update to 1.1.6
- Critical9.8Unauthenticated Arbitrary File Upload
Wordpress Plugin Smart Product Review
≤1.0.4Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting
SportsPress – Sports Club & League Manager
≤2.7.8Update to 2.7.9
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.0.6.1Update to 7.0.6.2
- Medium6.4Cross-Site Scripting
Mortgage Calculator
<1.5.17Update to 1.5.17
- High8.8Cross-Site Request Forgery
Push Notifications for WordPress (Lite)
<6.0.1Update to 6.0.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Flex Local Fonts
≤1.0.0No patch available
- Medium4.3Plugin's Settings Update via Cross-Site Request Forgery
WP Admin Logo Changer
≤1.0No patch available
- Medium5.4Stored Cross-Site Scripting
Display Post Metadata
<1.5.0Update to 1.5.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Shiny Buttons – CSS3 Button Generator for WordPress
≤1.1.0No patch available
- Medium4.3Authenticated (Contributor+) Arbitrary Posts/Pages Access
Improved Include Page
≤1.2No patch available
- Medium4.3Missing Authorization
Page/Post Content Shortcode
≤1.0No patch available
- Critical9.8Unauthenticated SQL Injection
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
<6.67Update to 6.67
- Medium4.3Improper Access Control
User meta shortcodes
≤0.5No patch available
- High7.2Authenticated (Admin+) SQL Injection
Quotes Collection
≤2.5.2No patch available
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate Nofollow
≤1.4.8No patch available
- High8.8SQL Injection
Mediamatic – Media Library Folders
≤2.8.0Update to 2.8.1
- High7.2Admin+ SQL Injection
SEO Booster
≤3.7Update to 3.8
- High8.5Missing Authorization
Contact Form Advanced Database
≤1.0.8No patch available
- Medium4.8Authenticated (Admin+) Cross-Site Scripting
Security Audit
≤1.0.0No patch available
- Medium4.8Admin+ Stored Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.2Update to 2.6.3
- Medium6.1Reflected Cross-Site Scripting
Auto Featured Image (Auto Post Thumbnail)
≤3.9.2Update to 3.9.3
- Medium5.5Stored Cross-Site Scripting
Inspirational Quote Rotator
≤1.0.0No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.1Update to 2.6.2
- Critical9.0Unauthenticated PHP Object Injection
ToTop Link
≤1.7.1No patch available