CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1309)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8PHP Object Injection
Post Pay Counter
<2.731Update to 2.731
- Medium6.1Reflected Cross-site Scripting
Pinfinity
≤1.9.2Update to 2.0
- High8.8Human Resource Management System < 1.1 - SQL Injection
WPHRM – Human Resource Management System for Wordpress | WordPress
<1.1Update to 1.1
- Medium6.1Cross-Site Scripting
MC4WP: Mailchimp for WordPress
≤4.1.7Update to 4.1.8
- High7.5Unauthenticated Backup Download
BackWPup – WordPress Backup & Restore Plugin
<3.4.2Update to 3.4.2
- Medium6.1Unauthorized Cross-Site Scripting
Participants Database
≤1.7.5.9Update to 1.7.5.10
- Medium6.1Cross-Site Scripting
SmokeSignal
≤1.2.6Update to 1.2.7
- High8.8Cross-Site Request Forgery
Jayj Quicktag
<1.3.2Update to 1.3.2
- Medium6.1Reflected Cross-Site Scripting
JetBackup – Backup, Restore & Migrate
≤1.1.46Update to 1.1.47
- Medium6.1Reflected Cross-Site Scripting
Share on Diaspora
<0.7.2Update to 0.7.2
- Medium4.7Reflected Cross Site Scripting
Product Vendors
<2.0.36Update to 2.0.36
- Medium6.1Cross-Site Scripting
Contact Form, Drag and Drop Form Builder Plugin – Live Forms
<3.4.0Update to 3.4.0
- High7.2Authenticated SQL Injection via tag_id Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.3.51Update to 1.3.51
- Medium6.1Cross-Site Scripting
WP Job Board
≤4.5.1Update to 5.0
- Medium6.1Cross-Site Scripting
Embed Images in Comments
<0.6Update to 0.6
- Medium6.1Cross-Site Scripting
JetBackup – Backup, Restore & Migrate
<1.1.47Update to 1.1.47
- Medium5.4Stored Cross-Site Scripting
UpdraftPlus Premium
≤1.13.4Update to 1.13.5
- Critical9.8Blind SQL Injection
Loginizer
<1.3.6Update to 1.3.6
- Medium6.1Creative Multipurpose WordPress Theme < 11.2 - Cross-Site Scripting
Bridge - Creative Multipurpose WordPress Theme
<11.2Update to 11.2
- High8.8Cross-Site Request Forgery
Loginizer
<1.3.6Update to 1.3.6
- High8.0Authenticated SQL Injection
Podlove Podcast Publisher
<2.6.0Update to 2.6.0
- High7.2SQL Injection
Easy Modal
<2.1.0Update to 2.1.0
- Medium6.1Cross-Site Scripting
PressForward
<5.2.4Update to 5.2.4
- High7.2Authenticated (Admin+) SQL Injection
Easy Modal
<2.1.0Update to 2.1.0
- High8.8SQL Injection
RK Responsive Contact Form
≤1.0.0No patch available
- Medium6.1Event and Gym Fitness WordPress Theme <= 1.6.4 - Reflected Cross-Site Scripting
Gameplan - Event and Gym Fitness WordPress Theme
≤1.6.4No patch available
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤7.1.04Update to 7.1.05
- Critical9.8SQL Injection
Ultimate Product Catalog
≤4.2.22Update to 4.2.23
- Medium6.1Cross-Site Scripting
Ultimate Product Catalog
≤4.2.11Update to 4.2.12
- Medium6.1Cross-Site Scripting
Easy Testimonials
≤3.0.4No patch available