CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1314)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.5 | Email Injection | CVE-2017-18543 | — | |
| High7.5 | Improper Input Validation | CVE-2017-18545 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18544 | — | |
| Critical9.8 | SQL Injection | CVE-2017-18571 | — | |
| High8.8 | SQL Injection | CVE-2017-1002010 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002009 | — | |
| Medium5.3 | Change of Email Invitation Content | CVE-2017-6955 | — | |
| Medium4.3 | Authorization Bypass | CVE-2017-6954 | — | |
| High7.5 | Missing Authorization | CVE-2017-1002006 | — | |
| Critical9.8 | Arbitrary File Download | CVE-2017-1002008 | — | |
| High7.2 | SQL Injection via subscriber_email parameter | CVE-2017-6578 | — | |
| Critical9.8 | SQL Injection | CVE-2017-20247 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002005 | — | |
| High7.5 | Authorization Bypass | CVE-2017-1002007 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002004 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-1002001 | — | |
| Medium6.1 | HTML Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.0.31Update to 3.0.31 | CVE-2017-18574 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-1002003 | — | |
| Medium4.9 | Arbitrary File Deletion WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6816 | — | |
| Medium6.4 | Cross-Site Scripting via Taxonomy names WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6818 | — | |
| Medium6.4 | Authenticated Cross-Site Scripting in Youtube URL Embeds WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6817 | — | |
| Medium6.1 | Bypass URL Validation WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6815 | — | |
| High8.8 | Cross-Site Request Forgery via Press This WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6819 | — | |
| Medium6.4 | Cross-Site Scripting via Media Metadata WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6814 | — | |
| High7.2 | SQL Injection via filter_list | CVE-2017-6574 | — | |
| High7.2 | SQL Injection via id parameter | CVE-2017-6576 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2017-6102 | — | |
| Critical9.8 | Security Bypass to Database Login | CVE-2017-20066 | — | |
| Medium6.1 | Cross-Site Scripting via Cross-Site Request Forgery | CVE-2024-27948 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2017-20055 | — |
- High7.5Email Injection
Invite Anyone
<1.3.16Update to 1.3.16
- High7.5Improper Input Validation
Invite Anyone
≤1.3.15Update to 1.3.16
- High8.8Cross-Site Request Forgery
Invite Anyone
<1.3.16Update to 1.3.16
- Critical9.8SQL Injection
Search Everything
≤8.1.6Update to 8.1.7
- High8.8SQL Injection
Membership Simplified
<1.58Update to 1.58
- Critical9.8SQL Injection
Membership Simplified
≤1.58No patch available
- Medium5.3Change of Email Invitation Content
Invite Anyone
<1.3.15Update to 1.3.15
- Medium4.3Authorization Bypass
BuddyPress Docs
<1.9.3Update to 1.9.3
- High7.5Missing Authorization
DTracker
≤1.5No patch available
- Critical9.8Arbitrary File Download
Membership Simplified
≤1.58No patch available
- High7.2SQL Injection via subscriber_email parameter
Mail Masta
≤1.0No patch available
- Critical9.8SQL Injection
PICA Photo Gallery
≤1.0No patch available
- Critical9.8SQL Injection
DTracker
≤1.5No patch available
- High7.5Authorization Bypass
DTracker
≤1.5No patch available
- Critical9.8SQL Injection
DTracker
≤1.5No patch available
- Critical9.8Arbitrary File Upload
Mobile App Builder by WapPress
≤1.05No patch available
- Medium6.1HTML Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.0.31Update to 3.0.31
- Critical9.8Arbitrary File Upload
Wp2android
≤1.1.4No patch available
- Medium4.9Arbitrary File Deletion
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Cross-Site Scripting via Taxonomy names
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Authenticated Cross-Site Scripting in Youtube URL Embeds
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.1Bypass URL Validation
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- High8.8Cross-Site Request Forgery via Press This
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Cross-Site Scripting via Media Metadata
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- High7.2SQL Injection via filter_list
Mail Masta
≤1.0No patch available
- High7.2SQL Injection via id parameter
Mail Masta
≤1.0No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
wordpress plugin rockhoist-badges
≤1.2.2No patch available
- Critical9.8Security Bypass to Database Login
adminer
≤1.4.5No patch available
- Medium6.1Cross-Site Scripting via Cross-Site Request Forgery
Atahualpa
≤3.7.24No patch available
- Medium6.4Stored Cross-Site Scripting
Contact Form Plugin
≤4.0.1Update to 4.0.2