CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1246)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Authentication Bypass via Password Reset
YITH Easy Login & Register Popup for WooCommerce
≤1.8.0Update to 1.8.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Customer Support Ticket System & Helpdesk
<5.10.4Update to 5.10.4
- High7.2Admin+ SQL Injection
MainWP Child Reports
≤2.0.7Update to 2.0.8
- Medium6.4Contributor+ Stored Cross-Site Scripting
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player
≤2.1.2Update to 2.1.3
- Medium5.5Admin+ Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
<1.9.9Update to 1.9.9
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Polo Video Gallery – Best wordpress video gallery plugin
≤1.2No patch available
- Medium5.4Cross-Site Scripting
StreamCast – bring live radio to your site with a sleek player
<2.1.1Update to 2.1.1
- Medium5.4Reflected Cross-Site Scripting
eID Easy
≤4.6Update to 4.7
- Medium5.3Sensitive Information Disclosure
BulletProof Security
≤5.1Update to 5.2
- Medium6.9Stored Cross-Site Scripting
YITH Maintenance Mode
≤1.3.7Update to 1.3.8
- Medium6.4Contributor+ Stored Cross-Site Scripting
Compact WP Audio Player
≤1.9.6Update to 1.9.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
PlanSo Forms
≤2.6.4No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Shared Files – File Upload & Download Manager
<1.6.57Update to 1.6.57
- Critical9.9Authenticated Command Injection
WordPress PDF Light Viewer Plugin
≤1.4.11Update to 1.4.12
- Medium4.3Setting Change via Cross-Site Request Forgery
Compact WP Audio Player
≤1.9.6Update to 1.9.7
- Medium6.4Stored Cross-Site Scripting
Podcast Subscribe Buttons
<1.4.2Update to 1.4.2
- Medium6.4Contributor+ Stored Cross-Site Scripting
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
≤1.7.12Update to 1.7.13
- Medium5.3Sensitive Information Disclosure
Find My Blocks – Locate blocks on your site
<3.4.0Update to 3.4.0
- Medium4.8Admin+ Stored Cross-Site Scripting
Simple Social Media Share Buttons – Social Sharing for Everyone
≤3.2.3Update to 3.2.4
- High7.5Unauthenticated SQL Injection
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
<3.4.2Update to 3.4.2
- Medium6.1Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.1.13Update to 7.1.14
- Medium4.3Missing Authorization
CURCY – Multi Currency for WooCommerce
≤2.1.17Update to 2.1.18
- Medium6.5Missing Authorization
CURCY - WooCommerce Multi Currency - Currency Switcher
≤2.1.17Update to 2.1.18
- Medium4.3Cross-Site Request Forgery leading to Arbitrary Domain Deletion
Software License Manager
<4.5.1Update to 4.5.1
- High8.8Authenticated (Contributor+) Code Injection
Gutenberg Block Editor Toolkit – EditorsKit
≤1.31.5Update to 1.31.6
- Medium4.8Admin+ Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.3.1Update to 7.3.2
- Critical9.8Arbitrary File Upload
Download from files
≤1.48No patch available
- Medium4.8wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting
Comments – wpDiscuz
≤7.3.0Update to 7.3.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Coming soon and Maintenance mode
<3.5.3Update to 3.5.3
- Medium6.5Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.1Update to 13.1.2