CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1283)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.82.6.7.6 - PHP Object Injection
Popup Builder – Create highly converting, mobile friendly marketing popups.
2.2.8 – 2.6.7.6Update to 3.0
- High8.1Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.2 - SQL Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.3Update to 4.6.0.3
- Medium6.4Authenticated Stored Cross-Site Scripting and Authorization Bypass
CookieYes – Cookie Banner, Cookie Consent & Cookie Notice for GDPR/CCPA
≤1.8.2Update to 1.8.3
- High7.5SQL Injection
Participants Database
<1.9.5.6Update to 1.9.5.6
- Medium6.38.6 - Missing Authorization Checks
Indeed Membership Pro
7.3 – 8.6Update to 8.6.1
- Critical9.88.6 - Authentication Bypass
Indeed Membership Pro
7.3 – <8.6.1Update to 8.6.1
- High7.5Unauthenticated Information Disclosure
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.5Update to 5.5.1
- High8.0Authenticated (Subscriber+) Arbitrary File Deletion
WP Fastest Cache – WordPress Cache Plugin
<0.9.0.3Update to 0.9.0.3
- High8.8Cross-Site Request Forgery
Tutor LMS – eLearning and online course solution
<1.5.3Update to 1.5.3
- Medium6.4Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.23Update to 3.4.23
- High8.8Cross-Site Request Forgery
Htaccess by BestWebSoft – WordPress Website Access Control Plugin
≤1.8.1Update to 1.8.2
- Medium6.1Stored Cross Site Scripting
Strong Testimonials
≤2.40.0Update to 2.40.1
- High8.0Authenticated (Author+) CSV Injection
TablePress – Tables in WordPress made easy
≤1.14Update to 2.0
- Medium6.13.11.2 - Cross-Site Scripting
Login by Auth0
3.11.0 – 3.11.2Update to 3.11.3
- Medium6.4Cross-Site Scripting
gistpress
<3.0.2Update to 3.0.2
- Medium6.1Cross-Site Scripting
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.1Update to 4.6.0.3
- Medium6.1Reflected Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.8.4Update to 2.8.5
- High8.8Cross-Site Request Forgery to Remote Code Execution
Code Snippets
≤2.13.3Update to 2.14.0
- Medium6.1Cross-Site Scripting
SAML Single Sign On – SSO Login
≤4.8.83Update to 4.8.84
- Critical9.8Authentication Bypass
Wordable – Export Google Docs to WordPress
<3.1.2Update to 3.1.2
- Medium5.3Hidden Login Page Location Disclosure
WPS Hide Login
≤1.5.4.2Update to 1.5.5
- Medium5.4Authenticated Stored Cross-Site Scripting
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤1.0.353Update to 1.0.354
- Medium6.1Cross-Site Scripting
Chatbot with IBM watsonx Assistant
<0.8.21Update to 0.8.21
- Medium5.3Insecure Direct Object Reference via order_id Parameter
WooCommerce
<4.7.0Update to 4.7.0
- Critical9.8Arbitrary Code Execution
AccessAlly
<3.3.2Update to 3.3.2
- Medium5.4Authorization Bypass
Slideshow, Image Slider by 2J
≤1.3.31Update to 1.3.33
- High7.2Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.8.3Update to 2.8.4
- High8.8Cross-Site Request Forgery
Marketo Forms and Tracking
≤1.0.2No patch available
- Critical9.1Unauthenticated Database Reset
Database Reset
≤3.1Update to 3.15
- Medium6.1Reflected Cross-Site Scripting
Chained Quiz
<1.1.8.2Update to 1.1.8.2