CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1264)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
WP Content Copy Protection & No Right Click
<3.1.5Update to 3.1.5
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Limit Login Attempts (Spam Protection)
<2.9Update to 2.9
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Visitor Traffic Real Time Statistics
≤2.11Update to 2.12
- High8.8Improper Authorization
WP Maintenance Mode & Site Under Construction
<1.5.2Update to 1.5.2
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
WP Maintenance Mode & Site Under Construction
<1.8.2Update to 1.8.2
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Login as User or Customer — User Switching
<1.8Update to 1.8
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WooCommerce
<5.2.0Update to 5.2.0
- Medium6.1Reflected Cross-Site Scripting
Accordions
<2.2.30Update to 2.2.30
- Medium5.5Authenticated Stored Cross-Site Scripting
RSS for Yandex Turbo
≤1.29Update to 1.30
- High7.5Unauthenticated Arbitrary Nonce Generation
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Critical9.8Arbitrary File Upload
Kaswara Modern VC Addons
≤3.0.1No patch available
- High8.8Authenticated PHP Object Injection
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium4.3Authenticated Arbitrary Post Deletion
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.3Unprotected AJAX Actions
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.5Authenticated Arbitrary Plugin Installation
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- Medium6.1Reflected Cross-Site scripting
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.14Update to 1.7.15
- Medium6.1Reflected Cross-Site Scripting
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.10.4Update to 1.10.5
- Medium6.1Multiple Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.69Update to 1.5.69
- Medium6.1Reflected Cross-Site scripting
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
≤1.2.4Update to 1.2.5
- Medium6.1Reflected Cross-Site Scripting <= 1.5.68 - Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- High8.8Cross-Site Request Forgery
404 SEO Redirection
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
404 SEO Redirection
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting via tab Parameter
All 404 Redirect to Homepage
<1.21Update to 1.21
- Medium4.8Authenticated Stored Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
≤6.4Update to 7.1
- Medium6.4Stored Cross-Site Scripting
Clever Addons for Elementor
<2.1.0Update to 2.1.0
- High7.1XXE Injection
WordPress
<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1
- Medium6.5Sensitive Information Disclosure
WordPress
<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤4.1.9Update to 2.0.7 or 4.1.10
- Medium5.4Cross-Site Request Forgery to Stored Cross-Site Scripting
fitness calculators
≤1.9.5Update to 1.9.6