CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1241)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Author+ Stored Cross-Site Scripting via Preview Module
YOP Poll
≤6.3.0Update to 6.3.1
- Medium5.4Author+ Stored Cross-Site Scripting via Options Module
YOP Poll
≤6.3.0Update to 6.3.1
- Medium6.1Stored Cross-Site Scripting
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤15.3Update to 15.4
- Medium5.5Stored Cross-Site Scripting
WpGenius Job Listing
≤1.0.2Update to 1.0.3
- Medium5.5Stored Cross-Site Scripting
WordPress ERP, HR, CRM, and Project Management Plugin – Business Manager
≤1.4.5Update to 1.4.6
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Job Board Vanila Plugin
1.0 – 1.0No patch available
- Medium5.5Authenticated Stored Cross-Site Scripting
Author Bio Box
≤3.3.1Update to 3.3.2
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Fastest Cache – WordPress Cache Plugin
<0.9.5Update to 0.9.5
- High8.8Authenticated (Subscriber+) SQL Injection
WP Fastest Cache – WordPress Cache Plugin
<0.9.5Update to 0.9.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
job-portal
≤0.0.1No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
MyBB Cross-Poster
≤1.0No patch available
- Medium5.5HAL <= 2.1.1 Authenticated Stored Cross-Site Scripting
HAL
≤2.1.1Update to 2.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Job Manager
≤0.7.25No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
KJM Admin Notices
≤2.0.1No patch available
- High8.8Backdoored
Frontend Post WordPress Plugin – AccessPress Anonymous Post
2.8.0 – 2.8.0Update to 2.8.1
- Medium4.3Cross-Site Request Forgery
Colorful Categories
<2.0.15Update to 2.0.15
- Medium6.4Page Builder <= 2.3.11 - Stored Cross-Site Scripting
Brizy – Page Builder
≤2.3.11Update to 2.3.12
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Testimonial – WordPress Testimonial Showcase Plugin Grid Plus Testimonial Slider
<1.6.0Update to 1.6.0
- High8.8Authenticated (Admin+) SQL Injection
WP Cloudy, weather plugin
≤4.4.9No patch available
- High7.5Insecure Password Creation
Simple JWT Login – Allows you to use JWT on REST endpoints.
<3.3.0Update to 3.3.0
- High8.8Authenticated File Upload and Path Traversal
Brizy – Page Builder
≤2.3.11Update to 2.3.12
- Medium5.4Authenticated Stored Cross-Site Scripting
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
≤2.4.13Update to 2.4.14
- High7.2Authenticated SQL Injections
Header Footer Code Manager
<1.1.14Update to 1.1.14
- High8.1Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction
<3.7.1.6Update to 3.7.1.6
- Critical9.8Unauthenticated SQL Injection
Asgaros Forum
≤1.15.12Update to 1.15.13
- Medium6.1Reflected Cross-Site Scripting
WP Header Images
<2.0.1Update to 2.0.1
- High8.8SQL Injection
MAZ Loader – Preloader Builder for WordPress
<1.3.3Update to 1.3.3
- Medium6.5Authenticated PHP Code Injection
Loco Translate
<2.5.4Update to 2.5.4
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Quiz Tool Lite
≤2.3.15No patch available
- High8.8Cross-Site Request Forgery
WP SEO Redirect 301
<2.3.2Update to 2.3.2