CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1238)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Email Log
≤2.4.7Update to 2.4.8
- High8.0Missing Authorization to Visitor Monitoring & Chat Removal
Tawk.To Live Chat
<0.6.0Update to 0.6.0
- Medium6.1Reflected Cross-Site Scripting via rul_login_url, rul_logout_url Parameter
LoginWP (Formerly Peter's Login Redirect)
<3.0.0.5Update to 3.0.0.5
- Critical9.8Unauthenticated SQL Injection
Secure Copy Content Protection and Content Locking
≤2.8.1Update to 2.8.2
- Medium5.4Staff Member Stored Cross-Site Scripting
Online Scheduling and Appointment Booking System – Bookly
≤20.3Update to 20.3.1
- Medium6.4Authenticated Stored Cross-Site Scripting
Testimonial – WordPress Testimonial Showcase Plugin Grid Plus Testimonial Slider
≤1.6.1Update to 1.6.2
- Medium5.3Unauthenticated Information Disclosure
Visual Form Builder
<3.0.6Update to 3.0.6
- Medium6.1Reflected Cross-Site Scripting
WP Google Fonts
≤3.1.4Update to 3.1.5
- Medium5.3CSV Injection
Visual Form Builder
<3.0.6Update to 3.0.6
- Medium4.8Authenticated Stored Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.6.3Update to 3.6.3
- Medium5.5Cross-Site Scripting
Contact Form, Survey, Quiz & Popup Form Builder – ARForms
<1.5Update to 1.5
- Medium5.4Cross-Site Request Forgery
Email Tracker
≤5.2.6Update to 5.2.7
- Medium4.8Stored Cross-Site Scripting
Easy Google Maps by Supsystic – Custom Markers, Clustering & Map Themes
≤1.9.33Update to 1.10.1
- High8.2Unprotected REST-API Endpoints
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
≤2.6.4Update to 2.6.5
- Medium4.8Authenticated Cross-Site Scripting
Shop Page WP
<1.2.8Update to 1.2.8
- Medium4.8Admin+ Stored Cross-Site Scripting
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content
≤4.19.1Update to 4.19.2
- High7.2Admin+ SQL Injection
BSK PDF Manager
<3.1.2Update to 3.1.2
- High8.8Subscriber+ SQL Injection
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤2.2Update to 2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
GenerateBlocks
≤1.3.5Update to 1.4.0
- Medium5.4Subscriber+ Reflected Cross-Site Scripting
My Calendar – Accessible Event Manager
≤3.2.17Update to 3.2.18
- Medium6.1Reflected Cross-Site Scripting
Check & Log Email – Easy Email Testing & Mail logging
<1.0.4Update to 1.0.4
- High7.2Admin+ SQL Injection
Email Before Download
≤6.7Update to 6.8
- Medium5.4Stored Cross-Site Scripting
Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator
≤7.0.3Update to 7.0.4
- Medium6.1Reflected Cross-Site Scripting
Download Monitor
≤4.4.6Update to 4.4.7
- Medium6.8Authenticated (Admin+) Arbitrary File Download
Download Monitor
≤4.4.6Update to 4.4.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Download Monitor
≤4.4.6Update to 4.4.7
- Medium5.4Arbitrary Plugin Settings Update to Stored Cross-Site Scripting
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
<4.0.1Update to 4.0.1
- Medium4.3Cross-Site Request Forgery
URL Shortify – Simple and Easy URL Shortener
≤1.5.0Update to 1.5.1
- Critical9.8Unauthenticated SQL Injection
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Social Media Flying Icons | Floating Social Media Icon
≤4.3.5No patch available