CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1239)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Hidden Login Page Location Disclosure
WPS Hide Login
≤1.9.0Update to 1.9.1
- Medium6.1Reflected Cross-Site Scripting
Registrations for the Events Calendar – Event Registration Plugin
≤2.7.4Update to 2.7.5
- Medium6.4Cross-Site Scripting
About Author Box
<1.0.2Update to 1.0.2
- Medium5.4Missing Authorisation
Bulk Datetime Change
<1.12Update to 1.12
- High7.2Authenticated SQL Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.6.4Update to 3.6.4
- High8.1Missing Authorization to Database Wipe
HashThemes Demo Importer
≤1.1.1Update to 1.1.2
- Medium4.8Admin+ Stored Cross-Site Cross-Site Scripting
Ninja Tables – Responsive Table Builder for Data, Pricing & Product Tables
≤4.1.7Update to 4.1.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Editable Table Simple Fast FrontEnd From Sql tables
≤0.1.4No patch available
- Medium6.1eCommerce Product Catalog <= 3.0.38 Reflected Cross-Site Scripting
eCommerce Product Catalog
<3.0.39Update to 3.0.39
- Medium4.3Cross-Site Request Forgery
MAZ Loader – Preloader Builder for WordPress
≤1.4.0Update to 1.4.1
- Medium6.5Denial of Service
Reviews Plus
<1.2.14Update to 1.2.15
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Media Tags
≤3.2.0.2No patch available
- Medium5.5Authenticated Stored Cross-Site Scripting
Notification – Custom Notifications and Alerts for WordPress
≤7.2.4Update to 8.0.0
- Medium4.8Cross-Site Scripting
Slideshow Gallery LITE
<1.7.4Update to 1.7.4
- Medium5.4Contributor+ Stored Cross-Site Scripting
Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions
≤2.0.3Update to 2.0.4
- High7.2SQL Injection via orderby, order Parameters
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
<4.1.8Update to 4.1.8
- Medium5.5Stored Cross-Site Scripting
CM Video Lessons Manager – Simplify video lessons management for better education
≤1.7.1Update to 1.7.2
- Medium4.3Cross-Site Request Forgery
Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid
<1.2.5Update to 1.2.5
- High8.8Object Injection
Social Sharing Plugin – Sassy Social Share
3.3.23 – 3.3.23Update to 3.3.24
- Medium5.5Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting
Simple Job Board
≤2.9.4Update to 2.9.5
- Medium4.8Reflected Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.11.2Update to 2.11.2.1
- High7.2Arbitrary File Upload
Catch Themes Demo Import
≤1.7Update to 1.8
- High8.8Cross-Site Request Forgery
Core Tweaks WP Setup
≤4.1No patch available
- High8.8Authenticated (Contributor+) Arbitrary File Upload
Template Kit – Import
≤1.0.13Update to 1.0.14
- Medium5.4Stored Cross-Site Scripting
BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP
<1.2.6Update to 1.2.6
- High7.2Admin+ SQL Injection via orderby parameter
Download Monitor
<4.4.5Update to 4.4.5
- Medium4.8Admin+ Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.15.4Update to 1.15.4
- Medium6.1Reflected Cross-Site Scripting
Tutor LMS – eLearning and online course solution
≤1.9.10Update to 1.9.11
- Medium5.4Stored Cross-Site Scripting
Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid
<1.2.4Update to 1.2.4
- High8.1Cross-Site Request Forgery
Images to WebP
<1.9Update to 1.9