CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1331)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.2 | SQL Injection | CVE-2015-9458 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9313 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9460 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2015-3299 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9312 | — | |
| High7.2 | Blind SQL Injection | CVE-2015-9461 | — | |
| High7.5 | Arbitrary File Download | CVE-2015-9463 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5528 | — | |
| High7.2 | Blind SQL Injection | CVE-2015-9462 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9465 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2015-9479 | — | |
| High7.5 | Directory Traversal | CVE-2015-5468 | — | |
| Medium6.1 | Open Redirect | CVE-2015-5461 | — | |
| High7.5 | Directory Traversal to Arbitrary File Access | CVE-2015-9464 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9466 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9467 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9468 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-9340 | — | |
| High7.5 | Directory Traversal | CVE-2015-5469 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-5681 | — | |
| Critical9.1 | Path Traversal | CVE-2015-5609 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-5682 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2015-9314 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5057 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2015-9343 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9342 | — | |
| Critical9.8 | SQL Injection | CVE-2015-5599 | — | |
| High8.8 | Arbitrary Options Update | CVE-2015-9475 | — | |
| High7.5 | Directory Traversal | CVE-2015-4704 | — | |
| High8.8 | Fullscreen Portfolio & Blog HTML Theme <= 1.3.2 - Arbitrary Options Update | CVE-2015-9474 | — |
- High7.2SQL Injection
SEO SearchTerms Tagging 2
≤1.535No patch available
- Critical9.8SQL Injection
NewStatPress
<1.0.6Update to 1.0.6
- High8.8Authenticated SQL Injection
Pinpoint Booking System – Legacy version
<2.1Update to 2.1
- Medium6.1Unauthenticated Cross-Site Scripting
Floating Social Bar
≤1.1.6Update to 1.1.7
- Medium6.1Reflected Cross-Site Scripting
NewStatPress
<1.0.6Update to 1.0.6
- High7.2Blind SQL Injection
Awesome Filterable Portfolio
<1.9Update to 1.9
- High7.5Arbitrary File Download
S3Bubble Cloud Video with Adverts and Analytics
<4.8Update to 4.8
- Medium6.1Cross-Site Scripting
Floating Social Bar
<1.1.7Update to 1.1.7
- High7.2Blind SQL Injection
Awesome Filterable Portfolio
<1.9Update to 1.9
- High8.8Authenticated SQL Injection
YASR – Yet Another Star Rating Plugin for WordPress
<0.9.1Update to 0.9.1
- Critical9.8Unauthenticated Arbitrary File Upload
acf-frontend-display
≤2.0.6No patch available
- High7.5Directory Traversal
WP eCommerce Shop Styling
<2.6Update to 2.6
- Medium6.1Open Redirect
StageShow
<5.0.9Update to 5.0.9
- High7.5Directory Traversal to Arbitrary File Access
S3 Bubble Amazon S3 HTML5 Video with Adverts
≤0.7Update to 0.8
- Critical9.8SQL Injection
WTI Like Post
<1.4.3Update to 1.4.3
- Critical9.8SQL Injection
Broken Link Manager
<0.5.0Update to 0.5.0
- Medium6.1Cross-Site Scripting
Broken Link Manager
≤0.4.5Update to 0.5.0
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.0.0Update to 3.0.0
- High7.5Directory Traversal
MDC YouTube Downloader
<2.1.1Update to 2.1.1
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available
- Critical9.1Path Traversal
Image Export
≤1.1Update to 1.1.1
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available
- High7.2Stored Cross-Site Scripting
NewStatPress
≤1.0.3Update to 1.0.4
- Medium6.1Cross-Site Scripting
Broken Link Checker
<1.10.9Update to 1.10.9
- High8.8Cross-Site Request Forgery
WP Rollback – Rollback Plugins and Themes
<1.2.3Update to 1.2.3
- Medium6.1Cross-Site Scripting
WP Rollback – Rollback Plugins and Themes
<1.2.3Update to 1.2.3
- Critical9.8SQL Injection
Powerplay Gallery
≤3.3No patch available
- High8.8Arbitrary Options Update
Pont - Multipurpose Wordpress Theme | Business
≤1.5No patch available
- High7.5Directory Traversal
download-zip-attachments
≤1.0No patch available
- High8.8Fullscreen Portfolio & Blog HTML Theme <= 1.3.2 - Arbitrary Options Update
Simpolio - Fullscreen Portfolio & Blog HTML Theme
≤1.3.2No patch available