CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1276)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated Arbitrary File Upload
Autoptimize
≤2.7.6Update to 2.7.7
- Medium6.1Cross-Site Scripting via id Parameter
WP Floating Menu – One page navigator, sticky menu for WordPress
<1.4.1Update to 1.4.1
- High7.1Missing Authorization to Settings Update
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- High8.6Unauthenticated Arbitrary Post Deletion
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- High8.8Cross-Site Request Forgery
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- Medium4.3Authenticated Information Disclosure
Access Governance for WordPress (aka AAM)
≤6.6.1Update to 6.6.2
- Medium6.1Multiple Stored Cross-Site Scripting
WP Customer Reviews
≤3.4.2Update to 3.4.3
- Medium6.3Missing Authorization
Discount Rules for WooCommerce
≤2.0.2Update to 2.1.0
- High7.5Payment System Bypass
NAB Transact
<2.1.2Update to 2.1.2
- High8.84.2.12 - Unprotected AJAX Actions
Backup, Restore and Migrate your sites with XCloner
4.2.1 – 4.2.12Update to 4.2.153
- Critical9.8Cross-Site Request Forgery
Backup, Restore and Migrate your sites with XCloner
<4.2.153Update to 4.2.153
- High7.5Authenticated Authorization Bypass and Privilege Escalation
Access Governance for WordPress (aka AAM)
≤6.6.1Update to 6.6.2
- High8.6CSV injection via form entry
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.4.7Update to 1.4.8
- High7.5Unauthenticated Resource Access to Site Backups
File Manager
≤6.4Update to 6.5
- Medium6.1Cross-Site Scripting
Sell Media
<2.4.2Update to 2.4.2
- Medium6.1Reflected Cross-Site Scripting
Ultimate Appointment Booking & Scheduling
<1.1.10Update to 1.1.10
- Medium6.1Reflected Cross-Site Scripting
RSS Feed Widget
<2.8.1Update to 2.8.1
- Medium6.1Reflected Cross-Site Scripting
Admin Menu
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Nova Lite
<1.3.9Update to 1.3.9
- High8.3Missing Authorization
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤3.8.1Update to 3.8.2
- High7.4Missing Capabilities Check
Facebook Chat Plugin – Live Chat Plugin for WordPress
<1.6Update to 1.6
- High7.5Missing Authorization
Product Input Fields for WooCommerce
≤1.2.6Update to 1.2.7
- High8.2Unauthenticated Arbitrary File Deletion
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<7.0.1Update to 7.0.1
- High8.8Arbitrary File Upload
Divi Builder
≤4.3.2Update to 4.5.3
- Critical9.8Arbitrary File Upload
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<7.0.1Update to 7.0.1
- Medium6.5Reflected Cross-Site Scripting
Newsletter – Send awesome emails from WordPress
<6.8.2Update to 6.8.2
- High7.5Authenticated PHP Object Injection
Newsletter – Send awesome emails from WordPress
<6.8.2Update to 6.8.2
- Medium4.3Sensitive Information Disclosure
JetBackup – Backup, Restore & Migrate
≤1.4.0Update to 1.4.1
- Medium5.4Missing Authorization to Unauthorized Backup Location Change
JetBackup – Backup, Restore & Migrate
≤1.4.0Update to 1.4.1
- High8.8Cross-Site Request Forgery
Social Rocket – Social Sharing Plugin
<1.2.10Update to 1.2.10