CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1243)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.17.5.2.727 - Reflected Cross-Site Scripting via player_id Parameter
FV Flowplayer Video Player
7.5.0.727 – 7.5.2.727Update to 7.5.3.727
- Medium6.54.0.2 - Authenticated SQL Injection via id Parameter
WP Bannerize
2.0.0 – 4.0.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via IP
Perfect Survey
≤1.5.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Perfect Survey
≤1.5.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Simple Download Monitor
<3.9.5Update to 3.9.5
- Critical9.8Unauthenticated SQL Injection
Perfect Survey
<1.5.2Update to 1.5.2
- Medium4.3Missing Authorization on jobsearch_update_job_import_schedule_call() function
JobSearch WP Job Board
≤1.8.1Update to 1.8.2
- High8.8Missing Authorization to Arbitrary Options Update
JobSearch WP Job Board
≤1.8.1Update to 1.8.2
- Medium5.3Sensitive Data Exposure
Simple Download Monitor
<3.9.6Update to 3.9.6
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Survey Plus
≤1.0No patch available
- Medium4.8Google Language Translator <= 6.0.11 - Admin+ Stored Cross-Site Scripting
Translate WordPress – Google Language Translator
<6.0.12Update to 6.0.12
- Medium5.3Missing Authorization to Settings Change
JobSearch WP Job Board
≤1.8.1Update to 1.8.2
- High8.8Cross-Site Request Forgery
Perfect Survey
≤1.5.2No patch available
- Medium6.5Missing Authorization
Batch Cat
≤0.3No patch available
- Critical9.0Contributor+ Stored Cross-Site Scripting via File Thumbnail
Simple Download Monitor
≤3.9.4Update to 3.9.5
- Medium5.3Full Path Disclosure
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
<17.3Update to 17.3
- Medium4.3Contributor+ Arbitrary Thumbnail Removal
Simple Download Monitor
<3.9.6Update to 3.9.6
- Medium4.8Cross-Site Scripting
Booking.com Product Helper
<1.0.2Update to 1.0.2
- Medium4.8Cross-Site Scripting
Booking.com Banner Creator
<1.4.3Update to 1.4.3
- Medium4.3Plugin's Settings Update via Cross-Site Request Forgery
Far Future Expiry Header
≤1.4Update to 1.5
- Medium5.5Admin+ Stored Cross-Site Scripting
Events Made Easy
<2.2.24Update to 2.2.24
- Medium5.5Multiple Admin+ Cross Site Scripting
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤2.4.1Update to 2.4.2
- High8.8Accept Donations with PayPal <= 1.3.0 Cross-Site Request Forgery to Post Deletion
Accept Donations with PayPal & Stripe
<1.3.1Update to 1.3.1
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Accept Donations with PayPal & Stripe
≤1.3Update to 1.3.1
- High8.8Cross-Site Request Forgery
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
<1.9.9.41Update to 1.9.9.41
- Medium6.5Settings Update
Logo Slider and Showcase
<1.3.37Update to 1.3.37
- High7.6Missing Authorization to Stored Cross-Site Scripting
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg
≤2.7.0Update to 2.7.1
- Medium6.1Reflected Cross-Site Scripting
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
<1.9.9.41Update to 1.9.9.41
- Medium4.3Insecure Direct Object Reference
Image Source Control Lite – Show Image Credits and Captions
<2.3.1Update to 2.3.1
- Medium5.5Admin+ Stored Cross-Site Scripting
Coming Soon, Under Construction & Maintenance Mode By Dazzler
≤1.6.3Update to 1.6.7