CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 133)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
WP EasyCart: Shopping Cart and eCommerce Store
≤5.9.3Update to 5.9.4
- Medium6.1Reflected Cross-Site Scripting via 'wpf_fid' Parameter
Product Filter for WooCommerce by WBW
≤3.4.2Update to 3.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter
Podlove Podcast Publisher
≤4.5.5Update to 4.5.6
- Medium4.9Authenticated (Custom+) SQL Injection via 'status' Parameter
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.0Update to 1.31.1
- Medium6.6Authenticated (Administrator+) PHP Object Injection via Form Import
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.14.6Update to 3.14.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute
My Calendar – Accessible Event Manager
≤3.8.3Update to 3.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes
My Calendar – Accessible Event Manager
≤3.8.3Update to 3.8.4
- High8.8Authenticated (Author+) Remote Code Execution to Privilege Escalation
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment
≤3.1.10Update to 3.1.11
- High7.5Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.22Update to 4.1.23
- High7.5Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.22Update to 4.1.23
- High7.2Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
≤1.7.5Update to 1.7.6
- Medium5.3Captcha Bypass
Simple CAPTCHA with Cloudflare Turnstile
≤1.42.1Update to 1.42.3
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.22Update to 4.1.23
- High7.2Unauthenticated Stored Cross-Site Scripting
WPAdverts – Classifieds Plugin
≤2.3.3Update to 2.3.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values
Repeater Fields for Gravity Forms
≤3.0.4Update to 3.1.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Settings Update
WP-Stateless – Google Cloud Storage
≤4.4.1Update to 4.4.2
- Medium5.3Missing Authorization
Return Refund and Exchange For WooCommerce
≤4.6.4Update to 4.6.5
- Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤12.0.3Update to 12.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Page Visits Counter – Lite
≤1.2.3Update to 2.0.0
- Medium5.3Unauthenticated Unauthorized Lead and Search Manipulation
IMPress for IDX Broker
≤3.3.0Update to 3.3.1
- Medium5.3Missing Authorization
Thanko Thank You Page Customizer for WooCommerce
≤1.2.2Update to 1.2.3
- High8.1Unauthenticated PHP Object Injection
Wise Chat
≤3.4.2Update to 3.4.3
- Medium4.3Missing Authorization
MailMunch – Grow your Email List
≤3.3.0Update to 3.3.1
- Medium5.36.3.0 - Unauthenticated Second Factor Authentication Bypass
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤19.2Update to 19.3 or 6.3.1
- Medium6.1Unauthenticated Arbitrary Shortcode Execution
Simple CAPTCHA with Cloudflare Turnstile
≤1.42.1Update to 1.42.3
- Medium5.3Unauthenticated Inflated Gift Card Credit Acquisition
Ultimate Gift Cards for WooCommerce
<3.2.10Update to 3.2.10
- High7.26.2.5 - Unauthenticated Stored Cross-Site Scripting
Kirki – Freeform Page Builder, Website Builder & Customizer
6.2.1 – 6.2.5Update to 6.3.0
- Medium5.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.5No patch available
- Medium4.3Missing Authorization
IMPress for IDX Broker
≤3.3.0Update to 3.3.1
- Medium5.3Unauthorized WordPress Account Creation
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
<4.7.0Update to 4.7.0