CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1269)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery Bypass
Style Kits for Elementor
≤1.8.0Update to 1.8.1
- Medium4.3Cross-Site Request Forgery Bypass
ElasticPress
≤3.5.3Update to 3.5.4
- Medium4.3Cross-Site Request Forgery Bypass
Process Steps Template Designer
≤1.2.1Update to 1.3
- Medium4.3Cross-Site Request Forgery Bypass
Better Search – Relevant search results for WordPress
≤2.5.2Update to 2.5.3
- Medium4.3Cross-Site Request Forgery Bypass
Custom Banners
≤3.2.2Update to 3.3
- Medium4.3Cross-Site Request Forgery Bypass
Abandoned Cart Lite for WooCommerce
≤5.8.5Update to 5.8.6
- Medium5.4Cross-Site Request Forgery Bypass
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.13.5Update to 1.13.5
- High8.8Cross-Site Request Forgery to Settings Import
Better Search – Relevant search results for WordPress
<2.5.3Update to 2.5.3
- Medium4.3Cross-Site Request Forgery Bypass
Defender Security – Malware Scanner, Login Security & Firewall
≤2.4.6Update to 2.4.6.1
- Medium4.3Cross-Site Request Forgery Bypass
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
≤2.0.20Update to 2.0.21
- Medium5.4Reflected Cross-Site Scripting
File Manager
<7.1Update to 7.1
- Medium6.1Reflected Cross-Site Scripting
NextGen Gallery Pro
≤3.1.9Update to 3.1.11
- High7.5API Key Disclosure
Web-Stat – Live Visitor Analytics
≤1.4.0Update to 1.4.1
- Critical9.8Arbitrary File Creation
QuadMenu – Mega Menu
≤2.0.6Update to 2.0.7
- Medium6.4Cross-Site Scripting
Advanced Order Export For WooCommerce
≤3.1.7Update to 3.1.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Testimonial Rotator
≤3.0.3No patch available
- High7.2Authenticated Arbitrary File Upload
JetBackup – Backup, Restore & Migrate
≤1.5.9Update to 1.6.0
- Medium6.1Administrator Open Redirect
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- High8.8Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- Medium5.4Cross-Site Request Forgery to OAuth Service Disconnection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- Medium4.3Authenticated OAuth Connection Key Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34.1Update to 3.4.34.1
- Medium4.9Authenticated Arbitrary File Download
Theme Editor
≤2.5Update to 2.6
- Medium6.1Directory & Listings With Booking - WordPress Theme < 1.6.11 - Cross-Site Scripting
Listeo - Directory & Listings With Booking - WordPress Theme
<1.6.11Update to 1.6.11
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<4.0.4Update to 4.0.4
- Medium6.1Tour & Travel WordPress Theme < 2.0 - Reflected Cross-Site Scripting
Goto - Tour & Travel WordPress Theme
<2.0Update to 2.0
- High8.8Cross-Site Request Forgery to Setting Modification
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<4.0.4Update to 4.0.4
- High8.84.0.3 - Authenticated Arbitrary File Upload
Responsive Menu – Mobile Menu & Hamburger Menu Builder
4.0 – <4.0.4Update to 4.0.4
- Medium6.1Social Directory WordPress Theme <= 2.4.2 - Reflected Cross-Site Scripting
Wyzi - Social Directory WordPress Theme
≤2.4.2Update to 2.4.3
- High7.5Server-Side Request Forgery
Like Button Rating ♥ LikeBtn
<2.6.32Update to 2.6.32
- High8.8Cross-Site Request Forgery
Name Directory
≤1.17.4Update to 1.18