CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1297)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Request Forgery | CVE-2019-1000003 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2018-25436 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2024-51792 | — | |
| Critical9.8 | SQL Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.21.1Update to 3.3.21.2 | CVE-2019-15025 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-20462 | — | |
| High8.8 | SQL injection | CVE-2018-20556 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2018-20463 | — | |
| Medium5.5 | Authenticated Cross-Site Scripting | CVE-2018-16204 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20968 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20231 | — | |
| Critical9.1 | Remote Code Execution | CVE-2018-20156 | — | |
| Medium5.5 | Cross-Site Scripting | CVE-2018-5668 | — | |
| Medium4.3 | Authorization Bypass WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20152 | — | |
| High7.5 | Sensitive Information Disclosure WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20151 | — | |
| High8.8 | PHP Object Injection WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20148 | — | |
| Medium6.1 | WordPress Core < 5.0.1 Reflected Cross-Site Scripting WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20150 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting via Comments WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20153 | — | |
| High7.7 | Arbitrary File Deletion WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20147 | — | |
| Medium6.4 | Stored Cross-Site Scripting via File Uploads WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20149 | — | |
| Medium6.1 | Import Cross-Site Scripting | CVE-2018-20101 | — | |
| High7.5 | Arbitrary File Read | CVE-2019-15330 | — | |
| Medium5.4 | Author+ Stored Cross-Site Scripting | CVE-2018-20986 | — | |
| High8.8 | Authenticated SQL Injection via Settings Import | CVE-2019-15872 | — | |
| Critical9.8 | Local File Inclusion | CVE-2018-20985 | — | |
| Medium5.3 | User Enumeration | CVE-2018-19487 | — | |
| High8.8 | Unauthenticated Arbitrary Password Reset | CVE-2018-19488 | — | |
| Medium4.7 | Authenticated Open Redirect Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.19Update to 3.3.19.1 | CVE-2018-19796 | — | |
| Critical9.8 | Improper Access Control | CVE-2018-21007 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2018-19564 | — | |
| Critical9.8 | PHP Object Injection | CVE-2018-20984 | — |
- Medium6.1Cross-Site Request Forgery
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
<3.3.0Update to 3.3.0
- Critical9.8Arbitrary File Upload
Baggage Freight Shipping Australia
≤0.1.0No patch available
- Critical9.8Arbitrary File Upload
Audio Record
≤1.0No patch available
- Critical9.8SQL Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.21.1Update to 3.3.21.2
- Medium6.1Cross-Site Scripting
JSmol2WP
≤1.07No patch available
- High8.8SQL injection
Booking Calendar
≤8.4.3Update to 8.4.4
- High7.5Server-Side Request Forgery
JSmol2WP
≤1.07No patch available
- Medium5.5Authenticated Cross-Site Scripting
XML Sitemap Generator for Google
≤4.0.9Update to 4.1.0
- High8.8Cross-Site Request Forgery
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export
<1.4.2Update to 1.4.2
- High8.8Cross-Site Request Forgery
Two Factor Authentication
<1.3.13Update to 1.3.13
- Critical9.1Remote Code Execution
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Medium5.5Cross-Site Scripting
Read and Understood
<2.2Update to 2.2
- Medium4.3Authorization Bypass
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High7.5Sensitive Information Disclosure
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High8.8PHP Object Injection
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.1WordPress Core < 5.0.1 Reflected Cross-Site Scripting
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.4Authenticated Stored Cross-Site Scripting via Comments
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High7.7Arbitrary File Deletion
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.4Stored Cross-Site Scripting via File Uploads
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.1Import Cross-Site Scripting
Import and export users and customers
<1.12.1Update to 1.12.1
- High7.5Arbitrary File Read
WebP Express
<0.14.11Update to 0.14.11
- Medium5.4Author+ Stored Cross-Site Scripting
Advanced Custom Fields (ACF®)
<5.7.8Update to 5.7.8
- High8.8Authenticated SQL Injection via Settings Import
LoginPress | wp-login Custom Login Page Customizer
<1.1.16Update to 1.1.16
- Critical9.8Local File Inclusion
WP Payeezy Pay
<2.98Update to 2.98
- Medium5.3User Enumeration
WP JobHunt
<2.4Update to 2.4
- High8.8Unauthenticated Arbitrary Password Reset
WP JobHunt
<2.4Update to 2.4
- Medium4.7Authenticated Open Redirect
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.19Update to 3.3.19.1
- Critical9.8Improper Access Control
User Email Verification for WooCommerce
≤3.1.15Update to 3.2.0
- Medium6.1Stored Cross-Site Scripting
Easy Testimonials
<3.6Update to 3.6
- Critical9.8PHP Object Injection
Patreon WordPress
<1.2.2Update to 1.2.2