CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1250)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Recipe Card Blocks Lite
<2.8.1Update to 2.8.1
- Medium5.4Contributor+ Stored Cross-Site Scripting
WP Video Lightbox
≤1.9.2Update to 1.9.3
- Medium4.3Arbitrary Comment Deletion via Cross-Site Request Forgery
Comment Link Remove and Other Comment Tools
≤2.1.4Update to 2.1.6
- Medium6.5Arbitrary User's Hashed Password/Email/Username Disclosure
Timetable and Event Schedule by MotoPress
≤2.3.19Update to 2.4.0
- Medium6.4Unauthorised Event TimeSlot Update
Timetable and Event Schedule by MotoPress
≤2.4.1Update to 2.4.2
- Medium6.1Stored Cross-Site Scripting
Limit Login Attempts
<4.0.50Update to 4.0.50
- Critical9.1Unauthenticated Path Traversal in REST API
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤4.5.3Update to 4.5.4
- Medium5.4Author+ Stored Cross-Site Scripting
Timetable and Event Schedule by MotoPress
≤2.3.18Update to 2.3.19
- High8.1Subscriber+ Arbitrary File/Folder Deletion
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤4.5.3Update to 4.5.4
- Medium5.4Authenticated Stored Cross-Site Scripting
SimpLy Gallery
<2.2.1Update to 2.2.1
- Medium4.8Authenticated Stored Cross-Site Scripting
Post Views Counter
≤1.3.4Update to 1.3.5
- High7.2Authenticated (Admin+) Arbitrary File Upload
Simple Schools Staff Directory
≤1.1No patch available
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via blockType arguments
Fonts Plugin | Google Fonts, Adobe Fonts & Upload Fonts
<3.0.3Update to 3.0.3
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Shortcodes Ultimate – Content Elements
<5.10.2Update to 5.10.2
- Medium4.3Unauthorised Event TimeSlot Deletion
Timetable and Event Schedule by MotoPress
≤2.4.1Update to 2.4.2
- High7.2Authenticated (Admin+) SQL Injection
GSEOR – WordPress SEO Plugin
≤1.3No patch available
- High7.2Authenticated SQL Injection via product_id Parameter
Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More
<3.3.1.0Update to 3.3.1.0
- High7.2Authenticated (Admin+) SQL Injection
Display Users
≤2.0.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
MicroCopy
≤1.1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
The Sorter
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
WP iCommerce – the first interactive ecommerce for wordpress
≤1.1.1No patch available
- High8.8Authenticated (Admin+) SQL Injection
WP-Board
≤1.1(Beta)No patch available
- High7.2Authenticated (Admin+) SQL Injection
WP Domain Redirect
≤1.0No patch available
- High8.8Authenticated (Admin+) SQL Injection
WordPress Page Contact
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
RESPONSIVE 3D SLIDER
≤1.2No patch available
- Medium5.4Authenticated (Subscriber+) Stored Cross-Site Scripting
博客社交分享组件
≤1.4.4Update to 1.4.5
- Medium6.4Stored Cross-Site Scripting
ThinkTwit
<1.7.1Update to 1.7.1
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
WP EasyCart: Shopping Cart and eCommerce Store
≤5.1.0Update to 5.1.5
- High8.1Cross-Site Request Forgery
Print My Blog – Print, PDF, & eBook Converter WordPress Plugin
≤3.4.1Update to 3.4.2
- Medium5.4Cross-Site Scripting
Gutenslider – Image & Video Slider Block
<5.2.0Update to 5.2.0