CWE-918Vulnerability type

WordPress SSRF vulnerabilities (page 1319)

Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SSRF vulnerabilities (page 1319)
Severity	Vulnerability	CVE	Installs	Published
High8.8	Cross-Site Request Forgery WordPress<4.6Update to 4.6	CVE-2016-6897	—	Aug 16, 2016
Medium4.3	Authorization Bypass WordPress<4.6Update to 4.6	CVE-2016-10148	—	Aug 16, 2016
High8.8	Cross-Site Request Forgery Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox<1.8.6Update to 1.8.6	CVE-2016-10918	—	Aug 15, 2016
Medium6.1	Cross-Site Scripting LoginWP (Formerly Peter's Login Redirect)<2.9.1Update to 2.9.1	CVE-2016-10925	—	Aug 11, 2016
High8.8	Cross-Site Request Forgery Add From Server<3.3.2Update to 3.3.2	CVE-2016-10914	—	Aug 8, 2016
High8.8	Cross-Site Request Forgery WP Database Backup – Unlimited Database & Files Backup by Backup for WP<4.3.3Update to 4.3.3	CVE-2016-10874	—	Aug 4, 2016
Medium6.1	Reflected Cross-Site Scripting FormBuilder≤1.05Update to 1.06	CVE-2016-10910	—	Aug 4, 2016
Medium6.1	Reflected Cross-Site Scripting Activity Log – Monitor User and Agent Changes<2.3.2Update to 2.3.3	CVE-2016-10890	—	Aug 3, 2016
Medium6.1	Cross-Site Scripting Activity Log – Monitor User and Agent Changes<2.3.3Update to 2.3.3	CVE-2016-10891	—	Aug 3, 2016
Medium6.1	Cross-Site Scripting WP Database Backup – Unlimited Database & Files Backup by Backup for WP<4.3.3Update to 4.3.3	CVE-2016-10873	—	Aug 3, 2016
Medium5.4	Authenticated Stored Cross-Site Scripting Yoast SEO – Advanced SEO with real-time guidance and built-in AI<3.4.1Update to 3.4.1	CVE-2021-24153	—	Aug 2, 2016
Medium6.1	Cross-Site Scripting Uji Countdown≤2.0.6Update to 2.0.7	CVE-2016-10900	—	Aug 2, 2016
High8.8	Remote Code Execution wsecure lite<2.4Update to 2.4	CVE-2016-10960	—	Aug 2, 2016
Medium6.1	Cross-Site Scripting WP Database Backup – Unlimited Database & Files Backup by Backup for WP<4.3.1Update to 4.3.1	CVE-2016-10875	—	Aug 1, 2016
High8.8	Cross-Site Request Forgery to Arbitrary File Upload Estatik Real Estate Plugin≤2.3.0Update to 2.3.1	CVE-2016-10959	—	Aug 1, 2016
Critical9.8	Unauthenticated Arbitrary File Upload Estatik Real Estate Plugin≤2.3.0Update to 2.3.1	CVE-2016-10958	—	Aug 1, 2016
Medium6.1	Unauthenticated Stored Cross-Site Scripting 3CX Free Live Chat, Calls & Messaging≤6.2.03Update to 6.2.04	CVE-2016-10879	—	Aug 1, 2016
Medium6.1	Cross-Site Scripting WP-Polls≤2.73Update to 2.73.1	CVE-2016-10936	—	Jul 29, 2016
Medium6.1	Cross-Site Scripting WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<3.1.2Update to 3.1.2	CVE-2016-10878	—	Jul 27, 2016
Medium6.1	Cross-Site Scripting Total Security<3.4.1Update to 3.4.1	CVE-2016-10898	—	Jul 25, 2016
Medium5.3	Unauthenticated Settings Change Total Security≤3.4.0Update to 3.4.1	CVE-2016-10899	—	Jul 25, 2016
Medium6.1	Reflected Cross-Site Scripting WP Mail<1.2Update to 1.2	CVE-2017-5942	—	Jul 23, 2016
Medium6.1	Cross-Site Scripting Nofollow Links≤1.0.10Update to 1.0.11	CVE-2016-4833	—	Jul 20, 2016
High8.8	Cross-Site Request Forgery Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress<1.9.19Update to 1.9.19	CVE-2016-10962	—	Jul 19, 2016
Medium6.1	Cross-Site Scripting Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress<1.9.19Update to 1.9.19	CVE-2016-10963	—	Jul 19, 2016
Medium6.1	Cross-Site Scripting dwnldr≤1.0Update to 1.01	CVE-2016-10964	—	Jul 18, 2016
Critical9.8	Arbitrary File Upload Frontend File Manager Plugin<4.0Update to 4.0	CVE-2016-15042	—	Jul 16, 2016
Medium5.8	CSV Injection CampTix Event Ticketing<1.5Update to 1.5	CVE-2016-10762	—	Jul 15, 2016
Medium6.1	Cross-Site Scripting User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor<2.4.2Update to 2.4.2	CVE-2016-10911	—	Jul 13, 2016
Critical9.8	SQL Injection Photo Gallery by Ays – Responsive Image Gallery<1.0.1Update to 1.0.1	CVE-2016-10921	—	Jul 11, 2016

High8.8
Cross-Site Request Forgery
WordPress
<4.6Update to 4.6
CVE-2016-6897Aug 16, 2016
Medium4.3
Authorization Bypass
WordPress
<4.6Update to 4.6
CVE-2016-10148Aug 16, 2016
High8.8
Cross-Site Request Forgery
Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox
<1.8.6Update to 1.8.6
CVE-2016-10918Aug 15, 2016
Medium6.1
Cross-Site Scripting
LoginWP (Formerly Peter's Login Redirect)
<2.9.1Update to 2.9.1
CVE-2016-10925Aug 11, 2016
High8.8
Cross-Site Request Forgery
Add From Server
<3.3.2Update to 3.3.2
CVE-2016-10914Aug 8, 2016
High8.8
Cross-Site Request Forgery
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
<4.3.3Update to 4.3.3
CVE-2016-10874Aug 4, 2016
Medium6.1
Reflected Cross-Site Scripting
FormBuilder
≤1.05Update to 1.06
CVE-2016-10910Aug 4, 2016
Medium6.1
Reflected Cross-Site Scripting
Activity Log – Monitor User and Agent Changes
<2.3.2Update to 2.3.3
CVE-2016-10890Aug 3, 2016
Medium6.1
Cross-Site Scripting
Activity Log – Monitor User and Agent Changes
<2.3.3Update to 2.3.3
CVE-2016-10891Aug 3, 2016
Medium6.1
Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
<4.3.3Update to 4.3.3
CVE-2016-10873Aug 3, 2016
Medium5.4
Authenticated Stored Cross-Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
<3.4.1Update to 3.4.1
CVE-2021-24153Aug 2, 2016
Medium6.1
Cross-Site Scripting
Uji Countdown
≤2.0.6Update to 2.0.7
CVE-2016-10900Aug 2, 2016
High8.8
Remote Code Execution
wsecure lite
<2.4Update to 2.4
CVE-2016-10960Aug 2, 2016
Medium6.1
Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
<4.3.1Update to 4.3.1
CVE-2016-10875Aug 1, 2016
High8.8
Cross-Site Request Forgery to Arbitrary File Upload
Estatik Real Estate Plugin
≤2.3.0Update to 2.3.1
CVE-2016-10959Aug 1, 2016
Critical9.8
Unauthenticated Arbitrary File Upload
Estatik Real Estate Plugin
≤2.3.0Update to 2.3.1
CVE-2016-10958Aug 1, 2016
Medium6.1
Unauthenticated Stored Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤6.2.03Update to 6.2.04
CVE-2016-10879Aug 1, 2016
Medium6.1
Cross-Site Scripting
WP-Polls
≤2.73Update to 2.73.1
CVE-2016-10936Jul 29, 2016
Medium6.1
Cross-Site Scripting
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<3.1.2Update to 3.1.2
CVE-2016-10878Jul 27, 2016
Medium6.1
Cross-Site Scripting
Total Security
<3.4.1Update to 3.4.1
CVE-2016-10898Jul 25, 2016
Medium5.3
Unauthenticated Settings Change
Total Security
≤3.4.0Update to 3.4.1
CVE-2016-10899Jul 25, 2016
Medium6.1
Reflected Cross-Site Scripting
WP Mail
<1.2Update to 1.2
CVE-2017-5942Jul 23, 2016
Medium6.1
Cross-Site Scripting
Nofollow Links
≤1.0.10Update to 1.0.11
CVE-2016-4833Jul 20, 2016
High8.8
Cross-Site Request Forgery
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
<1.9.19Update to 1.9.19
CVE-2016-10962Jul 19, 2016
Medium6.1
Cross-Site Scripting
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
<1.9.19Update to 1.9.19
CVE-2016-10963Jul 19, 2016
Medium6.1
Cross-Site Scripting
dwnldr
≤1.0Update to 1.01
CVE-2016-10964Jul 18, 2016
Critical9.8
Arbitrary File Upload
Frontend File Manager Plugin
<4.0Update to 4.0
CVE-2016-15042Jul 16, 2016
Medium5.8
CSV Injection
CampTix Event Ticketing
<1.5Update to 1.5
CVE-2016-10762Jul 15, 2016
Medium6.1
Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<2.4.2Update to 2.4.2
CVE-2016-10911Jul 13, 2016
Critical9.8
SQL Injection
Photo Gallery by Ays – Responsive Image Gallery
<1.0.1Update to 1.0.1
CVE-2016-10921Jul 11, 2016