CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1292)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery
Converter for Media – Optimize images | Convert WebP & AVIF
≤1.0.2Update to 1.0.3
- Medium5.4Authenticated Stored Cross-Site Scripting
WebP Express
<0.14.11Update to 0.14.11
- Medium5.4Stored Cross-Site Scripting
WP Ultimate Recipe
<3.12.7Update to 3.12.7
- Medium6.1Cross-Site Scripting
Limb Gallery | Create Beautiful Image & Video Galleries
<1.4.0Update to 1.4.0
- Medium6.1Reflected Cross-Site Scripting
Custom 404 Pro
<3.2.9Update to 3.2.9
- Medium5.7Cross-Site Request Forgery
Admin renamer extended
≤3.2.1No patch available
- Medium6.1Cross-Site Request Forgery and Stored Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.51Update to 2.0.52
- High8.8Cross-Site Request Forgery
HTML5 Maps
≤1.6.5.6Update to 1.6.5.7
- Medium6.1Reflected Cross-Site Scripting
Custom 404 Pro
<3.2.8Update to 3.2.8
- Medium5.4Cross-Site Request Forgery and Stored Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.51Update to 2.0.52
- High8.8Cross-site Request Forgery
Custom CSS Pro
≤1.0.3Update to 1.0.4
- Medium5.4Cross-Site Scripting
CP Contact Form with PayPal
<1.3.02Update to 1.3.02
- Medium6.1Cross-Site Scripting
CP Contact Form with PayPal
≤1.3.01Update to 1.3.02
- High8.8Cross-Site Request Forgery
Deny All Firewall
≤1.1.6Update to 1.1.7
- Medium6.3Cross-Site Request Forgery leading to attachment deletion & Path Traversal
Import and export users and customers
≤1.14.1.3Update to 1.14.2.2
- Medium6.5Authenticated Settings Reset via reset-cmb Parameter
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.27.1Update to 1.0.27.1
- High7.5Directory Traversal
Import and export users and customers
≤1.14.2.1Update to 1.14.2.2
- Medium6.1Cross-Site Scripting
Import and export users and customers
≤1.14.1.2Update to 1.14.1.3
- Critical9.8Local File Inclusion
Sina Extension for Elementor
<2.2.1Update to 2.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting via track_link
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<2.1.10Update to 2.1.10
- High8.8Cross-Site Request Forgery
GoHero Store Customizer for WooCommerce
≤2.4Update to 2.5
- High8.8Cross-Site Request Forgery allowing Option Update
Meta for WooCommerce
≤1.9.12Update to 1.9.15
- High8.8Cross-Site Request Forgery
Meta for WooCommerce
≤1.9.12Update to 1.9.15
- Medium4.3Unauthorized Profile Modification
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.39Update to 2.0.40
- High8.8Privilege Escalation
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.39Update to 2.0.40
- High8.8Cross-Site Request Forgery
WP-Members Membership Plugin
≤3.2.7Update to 3.2.8.1
- Medium6.1Stored Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.9.16Update to 2.9.16
- High8.8Cross-Site Request Forgery
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤10.4.4Update to 10.4.5
- High8.8Arbitrary File Upload
Insert or Embed Articulate Content into WordPress
<4.2999Update to 4.2999
- High8.8Cross-Site Request Forgery
Online Lesson Booking
≤0.8.6Update to 0.8.7