CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1311)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2017-18563 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-9419 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2017-1002017 | — | |
| High8.8 | SQL Injection | CVE-2017-9603 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-2195 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2017-9429 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-9420 | — | |
| High8.8 | SQL Injection | CVE-2017-9418 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002018 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002019 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-15863 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18512 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002023 | — | |
| Critical9.8 | Authenticated SQL Injection | CVE-2017-1002020 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-1002022 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002021 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18522 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18523 | — | |
| Medium5.4 | Authorization Bypass Allowing Post Meta Updates WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9065 | — | |
| High7.7 | Server-Side Request Forgery WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9066 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2169 | — | |
| Medium5.5 | Cross-Site Scripting via Customizer WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9063 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2187 | — | |
| Medium5.3 | User Enumeration | CVE-2017-1000226 | — | |
| Medium6.3 | Mishandling Post Meta Values via XML-RPC WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9062 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2168 | — | |
| Medium6.4 | Stored Cross-Site Scripting via filenames WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9061 | — | |
| High8.8 | Cross-Site Request Forgery Filesystem Credential Update WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9064 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18578 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18547 | — |
- Medium6.1Cross-Site Scripting
RSVP and Event Management
<2.3.8Update to 2.3.8
- Medium6.1Cross-Site Scripting
WP Custom Fields Search
<1.0Update to 1.0
- High7.2Stored Cross-Site Scripting
Gift Certificate Creator
≤1.0Update to 1.1
- High8.8SQL Injection
WP Jobs
<1.5Update to 1.5
- High8.8Authenticated SQL Injection
Multi Feed Reader
≤2.2.3Update to 2.2.4
- High7.2Authenticated (Admin+) SQL Injection
Event List
<0.7.9Update to 0.7.9
- Medium6.1Reflected Cross-Site Scripting
Spiffy Calendar
<3.3.0Update to 3.3.0
- High8.8SQL Injection
WP-Testimonials
≤3.4.1No patch available
- Critical9.8SQL Injection
Eventr
≤1.02.2No patch available
- Critical9.8SQL Injection
Eventr
≤1.02.2No patch available
- Medium6.1Reflected Cross-Site Scripting
wp-noexternallinks
<3.5.19Update to 3.5.19
- High8.8Cross-Site Request Forgery
Newsletter by Supsystic
<1.1.8Update to 1.1.8
- Critical9.8SQL Injection
Easy Team Manager
≤1.3.2No patch available
- Critical9.8Authenticated SQL Injection
surveys
≤1.01.8No patch available
- High8.8Authenticated SQL Injection
surveys
≤1.01.8No patch available
- Critical9.8SQL Injection
surveys
≤1.01.8No patch available
- Medium6.1Cross-Site Scripting
EELV Newsletter
<4.6.1Update to 4.6.1
- High8.8Cross-Site Request Forgery
EELV Newsletter
≤4.6.0Update to 4.6.1
- Medium5.4Authorization Bypass Allowing Post Meta Updates
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- High7.7Server-Side Request Forgery
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.1Cross-Site Scripting
MaxButtons – Create buttons
≤6.18Update to 6.19
- Medium5.5Cross-Site Scripting via Customizer
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤7.0.06Update to 7.0.07
- Medium5.3User Enumeration
Stop User Enumeration
<1.3.9Update to 1.3.9
- Medium6.3Mishandling Post Meta Values via XML-RPC
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.1Cross-Site Scripting
WP Booking System – Booking Calendar
<1.4Update to 1.4
- Medium6.4Stored Cross-Site Scripting via filenames
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- High8.8Cross-Site Request Forgery Filesystem Credential Update
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.1Cross-Site Scripting
Crafty Social Buttons
<1.5.8Update to 1.5.8
- High8.8Cross-Site Request Forgery
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
<4.6.4Update to 4.6.4