CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 127)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Admin+) Arbitrary File Upload
WP Import Export Lite
≤3.9.32Update to 3.9.33
- High7.2Authenticated (Admin+) Remote Code Execution
WP Import Export Lite
≤3.9.32Update to 3.9.33
- Medium4.3Missing Authorization
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.15Update to 5.0.16
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.34Update to 6.35
- Medium6.4Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute
Bridge - Creative Multipurpose WordPress Theme
≤30.8.9.1Update to 30.8.9.2
- High7.2Unauthenticated Arbitrary HTML Injection in Notification Emails
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1066Update to 1.7.1067
- Medium5.3Unauthenticated Information Exposure
Bookit — Booking & Appointment Calendar
<2.6.0.1Update to 2.6.0.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
rtMedia for WordPress, BuddyPress and bbPress
<4.7.12Update to 4.7.12
- Medium5.3Missing Authorization
Domain For Sale – Landing Page Per Domain, Domain Mapping, Offers & Listings
≤3.5.1Update to 3.5.2
- Medium5.35.2.7 - Unauthenticated Information Exposure
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
5.0 – 5.2.7Update to 5.2.8
- Medium4.3Authenticated (Contributor+) Information Exposure
WP Directory Kit
≤1.6.0Update to 1.6.1
- Medium4.71.9.8 - Authenticated (Administrator+) Privilege Escalation
Temporary Login Without Password
1.5 – 1.9.8Update to 1.9.9
- Medium4.33.4.0 - Authenticated (Custom Role+) Insecure Direct Object Reference
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
1.14.0 – 3.4.0Update to 3.4.1
- Medium5.3Unauthenticated Information Exposure
WP Directory Kit
<1.6.1Update to 1.6.1
- Medium4.3Missing Authorization
Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More
<3.1.1Update to 3.1.1
- Medium4.3Cross-Site Request Forgery
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
<1.2.2Update to 1.2.2
- Medium4.9Authenticated (Editor+) SQL Injection
WP Directory Kit
≤1.5.8Update to 1.5.9
- Medium5.3Missing Authorization
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
<8.5.7Update to 8.5.7
- Medium5.31.2.2 - Unauthenticated Insecure Direct Object Reference
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
1.0.9 – 1.2.2Update to 1.2.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Sprout Invoices – Client Invoicing & Estimates
<20.8.16Update to 20.8.16
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
<1.2.2Update to 1.2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Custom Menu Wizard Widget
≤3.3.1No patch available
- Medium6.4Authenticated (Custom Role+) Stored Cross-Site Scripting
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
<3.4.1Update to 3.4.1
- Medium5.31.10.0 - Unauthenticated Information Exposure
SureRank SEO – Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph
1.6.2 – 1.10.0Update to 1.10.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Highlight Box
≤1.0No patch available
- Medium4.3Cross-Site Request Forgery
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
<1.2.2Update to 1.2.2
- Medium6.5Unauthenticated SQL Injection via URL Path
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤4.2.1Update to 4.2.2
- High7.5Unauthenticated Local File Inclusion
GEO my WP
≤4.5.5.3Update to 4.5.5.4
- High8.8Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
Tutor LMS – eLearning and online course solution
≤4.0.7Update to 4.0.8
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions
DT LMS – elearning, WordPress LMS Plugin
≤1.1Update to 1.2