CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1254)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Subscriber+ Arbitrary File Upload
SP Project & Document Manager
<4.24Update to 4.24
- Critical9.8Privilege Escalation
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium4.3Cross-Site Request Forgery leading to Settings Change
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.5Cross-Site Request Forgery
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium5.4Cross-Site Request Forgery
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.1Reflected Cross-Site Scripting
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.1Reflected Cross-Site Scripting
Favicon by RealFaviconGenerator
<1.3.21Update to 1.3.21
- High8.8add sticky fixed buttons < 2.2.6 - SQL Injection
Side Menu Lite – Sticky Floating Side Menu
<2.2.6Update to 2.2.6
- High8.8Cross-Site Request Forgery
Blue Admin
≤21.06.01No patch available
- High7.1Authenticated Insecure Direct Object References (IDOR)
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- High8.8Cross-Site Request Forgery
SEO Backlinks
≤4.0.1No patch available
- High8.8Admin Custom Login <= 3.2.7 – Cross-Site Request Forgery to Stored Cross-Site Scripting
Admin Custom Login
≤3.2.7Update to 3.2.8
- Medium6.1Poll Maker <= 3.2.8 – Reflected Cross-Site Scripting
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
≤3.2.8Update to 3.2.9
- Critical9.9Authenticated WordPress Options Change
Advanced Shipment Tracking for WooCommerce
≤3.2.6Update to 3.2.7
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
LukasApps CAPTCHA tools for Contact Form 7
<0.0.9Update to 0.0.9
- Medium4.8Authenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.12.0Update to 2.12.0
- High8.8Post Index <= 0.7.5 Cross-Site Request Forgery to Stored Cross-Site Scripting
Post Index
≤0.7.5No patch available
- High8.8SQL Injection
Slider Hero with Video Background, Animation
<8.2.7Update to 8.2.7
- Medium5.5Authenticated Stored Cross-Site Scripting
WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS
<5.4.13Update to 5.4.13
- Medium5.4Contributor+ Stored Cross-Site Scripting
Simple Social Media Share Buttons – Social Sharing for Everyone
≤3.2.2Update to 3.2.3
- Critical9.8Unauthenticated SQL Injection
Directory Listings WordPress plugin – uListing
≤2.0.3Update to 2.0.4
- Medium5.4Stored Cross-Site Scripting
HD Quiz
<1.8.4Update to 1.8.4
- Medium6.4Cross-Site Scripting
Qyrr – simply and modern QR-Code creation
≤0.7Update to 0.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
≤2.10.3Update to 2.10.4
- Medium5.4Authenticated Stored Cross-Site Scripting
WPFront Scroll Top
≤2.0.5Update to 2.0.6
- Critical9.8Unauthenticated SQL Injection
Edit Comments
≤0.3No patch available
- High7.2Authenticated (Admin+) SQL Injection
Paytm – Donation Plugin
≤1.3.2No patch available
- Medium5.4Reflected Cross-Site Scripting
Project Status
≤1.6No patch available
- High7.2Authenticated (Admin+) SQL Injection
M-vSlider
≤2.1.3No patch available
- High7.2Authenticated SQL Injection
Simple Events Calendar
≤1.4.0Update to 1.4.1