CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1321)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | SQL Injection | CVE-2016-15040 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2016-4812 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2017-9337 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10973 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10974 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10975 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10885 | — | |
| High8.1 | 2.9.42 - PHP Object Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder2.9.36 – 2.9.42Update to 2.9.42.1 | CVE-2016-1209 | — | |
| Critical9.8 | SQL Injection | CVE-2016-11018 | — | |
| Medium6.5 | Directory Traversal | CVE-2016-10977 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10893 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2015-10128 | — | |
| Medium6.4 | Cross-Site Scripting via MediaElement.js WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2 | CVE-2016-4567 | — | |
| Medium6.1 | Cross-Site Scripting via plupload.flash.swf WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2 | CVE-2016-4566 | — | |
| High7.2 | Cross-Site Scripting | CVE-2016-10976 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10994 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2016-15041 | — | |
| High7.5 | Missing Authorization Checks | CVE-2016-10983 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2016-10897 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10920 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-10995 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10987 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10985 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10984 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10986 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10870 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2016-10981 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2016-10988 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10982 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10989 | — |
- Critical9.8SQL Injection
Kento Post View Counter
≤2.8No patch available
- Medium6.1Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5Update to 2.5.1
- Medium6.1Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Brafton
<3.4.8Update to 3.4.8
- High8.8Cross-Site Request Forgery
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
- Medium6.1Reflected Cross-Site Scripting
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
- High8.8Cross-Site Request Forgery
WP Editor
<1.2.6Update to 1.2.6
- High8.12.9.42 - PHP Object Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
2.9.36 – 2.9.42Update to 2.9.42.1
- Critical9.8SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.8.9Update to 1.9.0
- Medium6.5Directory Traversal
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤4.4.4Update to 4.5.0
- Medium6.1Cross-Site Scripting
Crayon Syntax Highlighter
<2.8.4Update to 2.8.4
- Medium6.4Authenticated Stored Cross-Site Scripting
Royal PrettyPhoto
≤1.2Update to 1.3
- Medium6.4Cross-Site Scripting via MediaElement.js
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
- Medium6.1Cross-Site Scripting via plupload.flash.swf
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
- High7.2Cross-Site Scripting
Safe Editor
<1.2Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
Truemag
all versionsNo patch available
- High7.2Stored Cross-Site Scripting
MainWP Dashboard: Self-hosted WordPress Management for Agencies
<3.1.3Update to 3.1.3
- High7.5Missing Authorization Checks
Ghost
≤0.5.5Update to 0.5.6
- Medium6.1Multiple Cross-Site Scripting
Sermon Browser
≤0.45.15Update to 0.45.16
- Medium6.1Cross-Site Scripting
GNUCommerce
<0.5.7-betaUpdate to 0.5.7-beta
- Critical9.8Arbitrary File Upload
Tevolution
<2.3.0Update to 2.3.0
- Medium6.1Cross-Site Scripting
افزونه پیامک ووکامرس | Persian WooCommerce SMS
≤3.3.2Update to 3.3.3
- Medium6.1Reflected Cross-Site Scripting
Echo Sign
<1.2Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
Echo Sign
<1.2Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
Tweet Wheel
<1.0.3.3Update to 1.0.3.3
- Medium6.1Cross-Site Scripting
Translate WordPress – Google Language Translator
<5.0.06Update to 5.0.06
- Medium6.1Stored Cross-Site Scripting
Kento Post View Counter
≤2.8No patch available
- Medium5.4Stored Cross-Site Scripting
leenk.me
<2.6.0Update to 2.6.0
- High8.8Cross-Site Request Forgery
Kento Post View Counter
≤2.8No patch available
- High8.8Cross-Site Request Forgery
leenk.me
≤2.5.0Update to 2.6.0