CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1259)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery Bypass
Edwiser Bridge – WordPress Moodle Integration
≤2.0.6Update to 2.0.7
- Medium6.1Reflected Cross-Site Scripting
event-espresso-core
≤4.10.6.pUpdate to 4.10.7.p
- Critical9.8Unauthenticated Arbitrary File Upload
ZoomSounds - WordPress Wave Audio Player with Playlist
≤5.96Update to 6.05
- Medium6.4Authenticated Cross-Site Scripting
WP Popular Posts
<5.3.3Update to 5.3.3
- Medium5.3Local File Inclusion
WP Image Zoom
≤1.46Update to 1.47.1
- High7.1Cross-Site Scripting
Fudousan Plugin
≤5.7.0No patch available
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
CiviCRM for WordPress
≤5.28.0Update to 5.28.1
- Critical9.8Unauthenticated Blind SQL Injection
Poll, Survey, Questionnaire and Voting system
<1.5.3Update to 1.5.3
- Medium6.1Stored Cross-Site Scripting
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
<6.3.1Update to 6.3.1
- Medium5.4Admin Columns Free < 4.3.2 and Pro < 5.5.2 Authenticated Stored Cross-Site Scripting
Admin Columns
<4.3.2Update to 4.3.2
- Medium4.3Cross-Site Request Forgery Bypass
Contact Form 7 Style
≤3.2No patch available
- High7.2Authenticated (Admin+) SQL Injection
Export Users With Meta
<0.6.5Update to 0.6.5
- Medium4.8Authenticated Stored Cross-Site Scripting
My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)
<2.5.2Update to 2.5.2
- Medium6.1Reflected Cross-Site Scripting
Prismatic
≤2.7Update to 2.8
- High8.0Authenticated CSV Injection
Sign-up Sheets
<1.0.14Update to 1.0.14
- Medium4.3Cross-Site Request Forgery Bypass
Staff Directory Plugin: Company Directory
≤3.6Update to 4.0
- Medium4.3Cross-Site Request Forgery Bypass
Ultimate Gift Cards for WooCommerce
≤2.1.1Update to 2.1.2
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Glass
≤1.3.2No patch available
- Medium4.3Cross-Site Request Forgery Bypass
wp-mpdf
≤3.5.1Update to 3.5.2
- Medium4.3Cross-Site Request Forgery Bypass
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤2.8.28Update to 2.8.29
- Medium4.3Cross-Site Request Forgery Bypass
Absolute Reviews
≤1.0.8Update to 1.0.9
- Medium5.4Stored Cross-Site Scripting
Prismatic
≤2.7Update to 2.8
- Medium4.8Stored Cross-Site Scripting
Sign-up Sheets
<1.0.14Update to 1.0.14
- Medium5.4Stored Cross-Site Scripting
Browser Screenshots
<1.7.6Update to 1.7.6
- Medium4.3Cross-Site Request Forgery Bypass
DW Question & Answer
≤1.5.8No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
simple sort&search
≤0.0.3No patch available
- Medium4.3Cross-Site Request Forgery Bypass
Remove Schema
≤1.5Update to 1.6
- Medium6.4Missing Authorization to Redirect Creation
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
≤3.0.7Update to 3.0.8
- Medium6.1Unauthenticated Stored Cross-Site Scripting
YOP Poll
≤6.2.7Update to 6.2.8
- Critical9.8Unauthenticated SQL Injection
FileBird – WordPress Media Library Folders & File Manager
4.7.3 – 4.7.3Update to 4.7.4