CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1310)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2017-1000227 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2017-12068 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2017-18600 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18539 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18540 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2017-1000224 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-2284 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2285 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002028 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18538 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2017-18601 | — | |
| Medium6.1 | Open Redirect | CVE-2017-2217 | — | |
| High8.8 | SQL Injection | CVE-2017-18602 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18508 | — | |
| Medium6.1 | Authenticated Cross-Site Scripting | CVE-2017-10991 | — | |
| Critical9.8 | SQL Injection via id Parameter | CVE-2017-13137 | — | |
| High7.2 | SQL Injection | CVE-2017-1002025 | — | |
| Medium4.3 | XML External Entity Injection | CVE-2017-10889 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-1002026 | — | |
| Critical9.8 | SQL Injection | CVE-2017-9834 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-18515 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18511 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18603 | — | |
| Medium5.0 | Directory Traversal | CVE-2017-2245 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18554 | — | |
| High7.5 | Local File Inclusion | CVE-2017-11658 | — | |
| Medium6.4 | Authenticated Cross-Site Scripting | CVE-2017-2224 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18032 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2222 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-2216 | — |
- Medium6.4Authenticated Stored Cross-Site Scripting
Salutation
<3.0.16Update to 3.0.16
- Medium6.1Unauthenticated Cross-Site Scripting
Event List
≤0.7.9Update to 0.7.10
- Medium5.4Authenticated Stored Cross-Site Scripting
FormCraft
<3.4Update to 3.4
- Medium6.1Cross-Site Scripting
WebLibrarian
<3.4.8.6Update to 3.4.8.6
- Medium6.1Cross-Site Scripting
WebLibrarian
<3.4.8.7Update to 3.4.8.7
- Medium6.5Cross-Site Request Forgery
Embed Plus for YouTube Gallery, Livestream and Lazy Loading with Facades
≤11.8.1Update to 11.8.2
- Medium6.1Reflected Cross-Site Scripting
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
<1.6.5Update to 1.6.5
- Medium6.1Cross-Site Scripting
Simple Custom CSS and JS
≤3.3Update to 3.4
- Critical9.8SQL Injection
wordpress-gallery-transformation
≤0.7No patch available
- Medium6.1Cross-Site Scripting
WebLibrarian
<3.4.8.5Update to 3.4.8.5
- Medium5.4Cross-Site Scripting
IBPS Online Exam Plugin for WordPress
≤1.0No patch available
- Medium6.1Open Redirect
Download Manager
<2.9.51Update to 2.9.51
- High8.8SQL Injection
IBPS Online Exam Plugin for WordPress
≤1.0No patch available
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤7.1.02Update to 7.1.03
- Medium6.1Authenticated Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.0.9Update to 12.0.10
- Critical9.8SQL Injection via id Parameter
FormCraft – Form Builder
1.0.5 – 1.0.5Update to 1.0.6
- High7.2SQL Injection
Add Edit Delete Listing Module
≤1.0No patch available
- Medium4.3XML External Entity Injection
TablePress – Tables in WordPress made easy
≤1.8Update to 1.8.1
- High8.8Authenticated SQL Injection
Event Expresso Free
≤3.1.37.11.LUpdate to 3.1.37.12.L
- Critical9.8SQL Injection
WatuPRO
<5.5.3.7Update to 5.5.3.7
- High8.8Authenticated SQL Injection
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.0.7Update to 12.0.8
- High8.8Cross-Site Request Forgery
Custom Sidebars – Dynamic Sidebar Classic Widget Area Manager
≤3.0.8Update to 3.0.8.1
- Medium6.1Reflected Cross-Site Scripting
Postman SMTP
≤1.7.2No patch available
- Medium5.0Directory Traversal
Shortcodes Ultimate – Content Elements
<4.10.0Update to 4.10.0
- Medium6.1Cross-Site Scripting
Analytics Tracker
≤1.1.0Update to 1.1.1
- High7.5Local File Inclusion
WP Rocket
<2.10.4Update to 2.10.4
- Medium6.4Authenticated Cross-Site Scripting
Event Calendar WD version
<1.0.94Update to 1.0.94
- Medium6.1Cross-Site Scripting
Download Manager
≤2.9.51Update to 2.9.52
- Medium6.1Cross-Site Scripting
WP-Members Membership Plugin
<3.1.8Update to 3.1.8
- Medium6.1Reflected Cross-Site Scripting
Download Manager
<2.9.50Update to 2.9.50