VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-918Vulnerability type

WordPress SSRF vulnerabilities (page 1325)

Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SSRF vulnerabilities (page 1325)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<1.3.29Update to 1.3.29
CVE-2015-8354—
High8.8Authenticated Blind SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.64Update to 1.5.64
CVE-2015-9395—
Critical9.8SQL Injection
Google Doc Embedder<2.5.17Update to 2.5.17
CVE-2014-9173—
Medium6.1Reflected Cross-Site Scripting
Auto Thickbox Plus≤1.9No patch available
CVE-2015-9396—
Critical9.8SQL Injection
Double Opt-In for Download<2.0.9Update to 2.0.9
CVE-2015-7517—
Medium6.1Reflected Cross-Site Scripting
Websimon Tables≤1.3.4No patch available
CVE-2015-9401—
High7.2Authenticated SQL Injection
WP-Stats-Dashboard≤2.9.4No patch available
CVE-2015-9399—
High7.2Authenticated (Admin+) SQL Injection
Watu Quiz≤2.6.7Update to 2.6.8
CVE-2015-10111—
High8.8Arbitrary File Upload
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.59Update to 1.5.59
CVE-2015-9402—
Critical9.8SQL Injection
WP Fastest Cache – WordPress Cache Plugin<0.8.4.9Update to 0.8.4.9
CVE-2015-9316—
Medium6.1Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor<2.2.5Update to 2.2.5
CVE-2015-9328—
High8.8Cross-Site Request Forgery
Tag Miner (Automatic Tag Extraction)<1.1.5Update to 1.1.5
CVE-2016-10978—
Medium6.1Cross-Site Scripting
Tag Miner (Automatic Tag Extraction)<1.1.5Update to 1.1.5
CVE-2016-10979—
Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll≤2.0No patch available
CVE-2015-9403—
Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll≤2.0No patch available
CVE-2015-9404—
Critical9.0Remote File Inclusion
Gwolle Guestbook<1.5.4Update to 1.5.4
CVE-2015-8351—
Medium6.1Cross-Site Scripting
WordPress Calls to Action<2.5.1Update to 2.5.1
CVE-2015-8350—
Critical9.8Arbitrary File Upload
Iptanus File Upload<3.4.1Update to 3.4.1
CVE-2015-9341—
High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Crony Cronjob Manager<0.4.7Update to 0.4.7
CVE-2017-14530—
Critical9.8SQL Injection
Visitors Online by BestWebSoft≤0.3Update to 0.4
CVE-2015-9325—
High8.8SQL Injection
wp-championship<5.9Update to 5.9
CVE-2015-5308—
High8.8Authenticated SQL Injection
Dynamic Widgets≤1.5.10Update to 1.5.11
CVE-2015-10100—
Medium6.1Cross-Site Scripting
Akismet Anti-spam: Spam Protection<3.1.5Update to 3.1.5
CVE-2015-9357—
Medium6.1Cross-Site Scripting
Connect Matomo – Analytics Dashboard for WordPress<1.0.5Update to 1.0.5
CVE-2015-9405—
Medium4.9Path Traversal
Font – official webfonts plugin of Fonts For Web. NO CODING! Just click & change font size, color and font face visually!≤7.5Update to 7.5.1
CVE-2015-7683—
Medium6.3Authenticated SQL Injection
Pie Register – User Registration, Profiles & Content Restriction<2.0.19Update to 2.0.19
CVE-2015-7682—
Medium6.1Reflected Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction<2.0.19Update to 2.0.19
CVE-2015-7377—
High8.8Arbitrary File Upload
Ajax Load More – Infinite Scroll, Load More, & Lazy Load≤2.8.1.1Update to 2.8.1.2
CVE-2015-10140—
Critical9.8SQL Injection
Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms<1.1.1Update to 1.1.1
CVE-2015-9335—
Critical9.8SQL Injection
Support Ticket System<1.2.1Update to 1.2.1
CVE-2015-7670—
  • Medium6.1
    Reflected Cross-Site Scripting

    Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    <1.3.29Update to 1.3.29

    CVE-2015-8354

  • High8.8
    Authenticated Blind SQL Injection

    Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin

    <1.5.64Update to 1.5.64

    CVE-2015-9395

  • Critical9.8
    SQL Injection

    Google Doc Embedder

    <2.5.17Update to 2.5.17

    CVE-2014-9173

  • Medium6.1
    Reflected Cross-Site Scripting

    Auto Thickbox Plus

    ≤1.9No patch available

    CVE-2015-9396

  • Critical9.8
    SQL Injection

    Double Opt-In for Download

    <2.0.9Update to 2.0.9

    CVE-2015-7517

  • Medium6.1
    Reflected Cross-Site Scripting

    Websimon Tables

    ≤1.3.4No patch available

    CVE-2015-9401

  • High7.2
    Authenticated SQL Injection

    WP-Stats-Dashboard

    ≤2.9.4No patch available

    CVE-2015-9399

  • High7.2
    Authenticated (Admin+) SQL Injection

    Watu Quiz

    ≤2.6.7Update to 2.6.8

    CVE-2015-10111

  • High8.8
    Arbitrary File Upload

    Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin

    <1.5.59Update to 1.5.59

    CVE-2015-9402

  • Critical9.8
    SQL Injection

    WP Fastest Cache – WordPress Cache Plugin

    <0.8.4.9Update to 0.8.4.9

    CVE-2015-9316

  • Medium6.1
    Reflected Cross-Site Scripting

    User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

    <2.2.5Update to 2.2.5

    CVE-2015-9328

  • High8.8
    Cross-Site Request Forgery

    Tag Miner (Automatic Tag Extraction)

    <1.1.5Update to 1.1.5

    CVE-2016-10978

  • Medium6.1
    Cross-Site Scripting

    Tag Miner (Automatic Tag Extraction)

    <1.1.5Update to 1.1.5

    CVE-2016-10979

  • Medium6.1
    Reflected Cross-Site Scripting

    neuvoo-jobroll

    ≤2.0No patch available

    CVE-2015-9403

  • Medium6.1
    Reflected Cross-Site Scripting

    neuvoo-jobroll

    ≤2.0No patch available

    CVE-2015-9404

  • Critical9.0
    Remote File Inclusion

    Gwolle Guestbook

    <1.5.4Update to 1.5.4

    CVE-2015-8351

  • Medium6.1
    Cross-Site Scripting

    WordPress Calls to Action

    <2.5.1Update to 2.5.1

    CVE-2015-8350

  • Critical9.8
    Arbitrary File Upload

    Iptanus File Upload

    <3.4.1Update to 3.4.1

    CVE-2015-9341

  • High8.8
    Cross-Site Request Forgery to Stored Cross-Site Scripting

    Crony Cronjob Manager

    <0.4.7Update to 0.4.7

    CVE-2017-14530

  • Critical9.8
    SQL Injection

    Visitors Online by BestWebSoft

    ≤0.3Update to 0.4

    CVE-2015-9325

  • High8.8
    SQL Injection

    wp-championship

    <5.9Update to 5.9

    CVE-2015-5308

  • High8.8
    Authenticated SQL Injection

    Dynamic Widgets

    ≤1.5.10Update to 1.5.11

    CVE-2015-10100

  • Medium6.1
    Cross-Site Scripting

    Akismet Anti-spam: Spam Protection

    <3.1.5Update to 3.1.5

    CVE-2015-9357

  • Medium6.1
    Cross-Site Scripting

    Connect Matomo – Analytics Dashboard for WordPress

    <1.0.5Update to 1.0.5

    CVE-2015-9405

  • Medium4.9
    Path Traversal

    Font – official webfonts plugin of Fonts For Web. NO CODING! Just click & change font size, color and font face visually!

    ≤7.5Update to 7.5.1

    CVE-2015-7683

  • Medium6.3
    Authenticated SQL Injection

    Pie Register – User Registration, Profiles & Content Restriction

    <2.0.19Update to 2.0.19

    CVE-2015-7682

  • Medium6.1
    Reflected Cross-Site Scripting

    Pie Register – User Registration, Profiles & Content Restriction

    <2.0.19Update to 2.0.19

    CVE-2015-7377

  • High8.8
    Arbitrary File Upload

    Ajax Load More – Infinite Scroll, Load More, & Lazy Load

    ≤2.8.1.1Update to 2.8.1.2

    CVE-2015-10140

  • Critical9.8
    SQL Injection

    Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms

    <1.1.1Update to 1.1.1

    CVE-2015-9335

  • Critical9.8
    SQL Injection

    Support Ticket System

    <1.2.1Update to 1.2.1

    CVE-2015-7670

Search VulnCrest Radar

Jump to

Are you sure?