CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1336)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9364 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9516 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9361 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9379 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9535 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9509 | — | |
| Medium6.1 | Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7 | CVE-2015-9505 | — | |
| Medium6.1 | Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7 | CVE-2015-9512 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9513 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9529 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9536 | — | |
| Critical9.8 | SQL Injection | CVE-2015-3313 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9365 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9511 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9524 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9532 | — | |
| Medium5.3 | Reflected Cross Site Scripting | CVE-2015-10098 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9373 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9519 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9368 | — | |
| Critical9.8 | SQL Injection | CVE-2015-3314 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9356 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9520 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9294 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9362 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9370 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9363 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9296 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9367 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9507 | — |
- Medium6.1Reflected Cross-Site Scripting
2Checkout Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Invoices
≤1.0.3Update to 1.0.4
- Medium6.1Reflected Cross-Site Scripting
Related Posts
≤1.8.1Update to 1.8.2
- Medium6.1Cross-Site Scripting
iThemes Builder Style Manager
<0.7.7Update to 0.7.7
- Medium6.1Cross-Site Scripting
Shoppette
<1.0.5Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – Content Restriction
≤2.0.7Update to 2.0.8
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
- Medium6.1Cross-Site Scripting
EDD Favorites
≤1.0.6Update to 1.0.7
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads (EDD) Stripe
≤2.1.2Update to 2.1.3
- Medium6.1Cross-Site Scripting
Twenty Twelve EDD
≤1.1Update to 1.1.1
- Critical9.8SQL Injection
Community Events
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
Authorize.net Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Conditional Success Redirects
<1.1.1Update to 1.1.1
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Recount Earnings
<2.3.7Update to 2.3.7
- Medium6.1Cross-Site Scripting
Easy Digital Downloads (EDD) Digital Store
<1.3.3Update to 1.3.3
- Medium5.3Reflected Cross Site Scripting
Broken Link Checker
<1.10.6Update to 1.10.6
- Medium6.1Cross-Site Scripting
PayPal Pro Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – PDF stamper
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Easy EU Value Added (VAT) Taxes Add-on
<1.2.0Update to 1.2.0
- Critical9.8SQL Injection
Tune Library
<1.5.5Update to 1.5.5
- Medium6.1Cross-Site Scripting
WP-ViperGB
<1.3.16Update to 1.3.16
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Per Product Emails
<1.0.9Update to 1.0.9
- Medium6.1Reflected Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<3.9.5Update to 3.9.5
- Medium6.1Reflected Cross-Site Scripting
Post Connector
<1.0.4Update to 1.0.4
- Medium6.1Reflected Cross-Site Scripting
Exchange Addon Invoices
<1.4.0Update to 1.4.0
- Medium6.1Cross-Site Scripting
ithemes-exchange
<1.12.0Update to 1.12.0
- Medium6.1Reflected Cross-Site Scripting
Download Monitor
<1.7.1Update to 1.7.1
- Medium6.1Reflected Cross-Site Scripting
Easy Canadian Sales Taxes Add-On for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – Attach Accounts to Orders
≤2.0.1Update to 2.0.2