CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1298)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Stored Cross-Site Scripting
AMP for WP – Accelerated Mobile Pages
≤0.9.97.20Update to 0.9.97.21
- Medium6.1Cross-Site Scripting via begin_date, end_date, or form_id Parameter
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.3.18Update to 3.3.18
- Medium5.4Authenticated Stored Cross-Site Scripting
Master Slider – Responsive Touch Slider
≤3.7.0Update to 3.7.5
- High7.5Directory Traversal
Media from FTP
<9.85Update to 9.85
- Medium5.4Stored Cross-Site Scripting
Custom Product Tabs for WooCommerce & WordPress Tabs Builder – Smart Tabs
≤1.8.0Update to 2.0.0
- Medium6.1Cross-Site Scripting
Weblizar Pin Feeds
<1.1.2Update to 1.1.2
- High8.8Cross-Site Request Forgery
Weblizar Pin Feeds
<1.1.2Update to 1.1.2
- Medium5.4Stored Cross-Site Scripting
Easy Custom Auto Excerpt
<2.4.7Update to 2.4.7
- High8.8Cross-Site Request Forgery
Read and Understood
<2.2Update to 2.2
- Medium6.1Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.0.12Update to 3.1.0
- Critical9.8SQL Injection
BuddyForms
≤2.2.7Update to 2.2.8
- High7.2Authenticated SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.0.12Update to 3.1.0
- Medium6.1Open Redirect
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.0.12Update to 3.1.0
- Critical9.8Arbitrary Options Update and Action Calling
Cookie Information | Free GDPR Consent Solution
<1.4.3Update to 1.4.3
- Critical9.8SQL Injection
RSVPMaker
<5.6.4Update to 5.6.4
- Medium6.6Race Condition to Remote Code Execution
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤9.1.0Update to 9.2.0
- High7.2WooCommerce File Deletion
WooCommerce
<3.4.6Update to 3.4.6
- Medium6.1Reflected Cross-Site Scripting
Media File Manager
≤1.4.2Update to 1.4.3
- Medium5.4Cross-Site Scripting
Event Calendar WD version
≤1.1.21Update to 1.1.22
- Critical9.8Arbitrary File Upload
GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership
≤1.4.13Update to 1.4.14
- Medium4.8Cross-Site Scripting
WP Editor.md – The Perfect WordPress Markdown Editor
<10.0.4Update to 10.0.4
- Medium5.4Authenticated Stored Cross-Site Scripting
Calendar
<1.3.11Update to 1.3.11
- Medium6.1Cross-Site Scripting
Elementor Website Builder Pro
<2.0.10Update to 2.0.10
- High7.5Unauthenticated Arbitrary File Deletion via Path Traversal
ARforms
<3.5.2Update to 3.5.2
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤8.0.15Update to 8.0.16
- Critical9.8Arbitrary File Upload
Arigato Autoresponder and Newsletter
all versionsNo patch available
- Medium6.4Cross-Site Scripting
Support Board
<1.2.4Update to 1.2.4
- Critical9.8Arbitrary File Upload
Tajer
≤1.0.5No patch available
- High8.8Cross-Site Request Forgery via page to wpfastestcacheoptions
WP Fastest Cache – WordPress Cache Plugin
≤0.8.8.5Update to 0.8.8.6
- Medium6.1Cross-Site Scripting via the rules[0][content] parameter in a wpfc_save_exclude_pages action
WP Fastest Cache – WordPress Cache Plugin
≤0.8.8.5Update to 0.8.8.6