CWE-918Vulnerability type

WordPress SSRF vulnerabilities (page 1337)

Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SSRF vulnerabilities (page 1337)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting ithemes-exchange<1.12.0Update to 1.12.0	CVE-2015-9363	—	Apr 20, 2015
Medium5.3	Reflected Cross Site Scripting Broken Link Checker<1.10.6Update to 1.10.6	CVE-2015-10098	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Authorize.net Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9365	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Mobile<1.2.8Update to 1.2.8	CVE-2015-9376	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Software Licensing<3.2.3Update to 3.2.3	CVE-2015-9528	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Canadian Sales Taxes Add-On for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9367	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Exchange Addon Invoices<1.4.0Update to 1.4.0	CVE-2015-9370	—	Apr 20, 2015
Medium5.4	Cross-Site Scripting via Ephox in Plupload WordPress≤4.1.1Update to 3.7.6 or 3.8.6 or 3.9.4 or 4.0.2 or 4.1.2	CVE-2015-3439	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Stripe Add-on for iThemes Exchange<1.2.0Update to 1.2.0	CVE-2015-9374	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Download Monitor<1.7.1Update to 1.7.1	CVE-2015-9296	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads - QR Codes≤1.1.0Update to 1.1.1	CVE-2015-9522	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Manual Purchases Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9371	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Exchange Addon Custom URL Tracking<1.1.0Update to 1.1.0	CVE-2015-9366	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Exchange Addon Membership<1.3.0Update to 1.3.0	CVE-2015-9372	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Market<5.1.27Update to 5.1.27	CVE-2015-9378	—	Apr 20, 2015
Medium6.1	Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting Easy Digital Downloads - Cross-Sell and Upsell≤1.1.2Update to 1.1.3	CVE-2015-9510	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads - Recurring Payments≤2.3Update to 2.3.1	CVE-2015-9525	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads - Amazon S3≤2.1.3Update to 2.1.4	CVE-2015-9506	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads - Free Downloads≤2.3.6Update to 2.3.7	CVE-2015-9514	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Two Factor Authentication<1.1.10Update to 1.1.10	CVE-2015-9355	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads - Product Reviews≤1.3.8Update to 1.3.10	CVE-2015-9526	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads - Wish Lists≤1.1Update to 1.1.1	CVE-2015-9531	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Shoppette<1.0.5Update to 1.0.5	CVE-2015-9535	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting TinyChat Room Spy≤1.2.8Update to 1.2.9	CVE-2015-10110	—	Apr 18, 2015
High7.5	Missing Access Controls User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor≤2.1.3Update to 2.1.4	CVE-2015-9337	—	Apr 15, 2015
Medium5.3	Cross-Site Scripting Contact Form by ContactMe.com≤2.3No patch available	CVE-2014-4518	—	Apr 15, 2015
Medium5.3	SQL Injection WP Symposium<15.4Update to 15.4	CVE-2015-3325	—	Apr 14, 2015
Medium6.1	Cross-Site Scripting My Wish List<1.4.2Update to 1.4.2	CVE-2015-9493	—	Apr 13, 2015
Critical9.8	Arbitrary File Upload Website Contact Form With File Upload≤1.3.4Update to 1.4	CVE-2015-10137	—	Apr 12, 2015
Critical9.8	SQL Injection cformsII<14.6.10Update to 14.6.10	CVE-2015-9333	—	Apr 11, 2015

Medium6.1
Cross-Site Scripting
ithemes-exchange
<1.12.0Update to 1.12.0
CVE-2015-9363Apr 20, 2015
Medium5.3
Reflected Cross Site Scripting
Broken Link Checker
<1.10.6Update to 1.10.6
CVE-2015-10098Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Authorize.net Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9365Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Mobile
<1.2.8Update to 1.2.8
CVE-2015-9376Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Software Licensing
<3.2.3Update to 3.2.3
CVE-2015-9528Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Canadian Sales Taxes Add-On for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9367Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Exchange Addon Invoices
<1.4.0Update to 1.4.0
CVE-2015-9370Apr 20, 2015
Medium5.4
Cross-Site Scripting via Ephox in Plupload
WordPress
≤4.1.1Update to 3.7.6 or 3.8.6 or 3.9.4 or 4.0.2 or 4.1.2
CVE-2015-3439Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Stripe Add-on for iThemes Exchange
<1.2.0Update to 1.2.0
CVE-2015-9374Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Download Monitor
<1.7.1Update to 1.7.1
CVE-2015-9296Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads - QR Codes
≤1.1.0Update to 1.1.1
CVE-2015-9522Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Manual Purchases Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9371Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Exchange Addon Custom URL Tracking
<1.1.0Update to 1.1.0
CVE-2015-9366Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Exchange Addon Membership
<1.3.0Update to 1.3.0
CVE-2015-9372Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Market
<5.1.27Update to 5.1.27
CVE-2015-9378Apr 20, 2015
Medium6.1
Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting
Easy Digital Downloads - Cross-Sell and Upsell
≤1.1.2Update to 1.1.3
CVE-2015-9510Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads - Recurring Payments
≤2.3Update to 2.3.1
CVE-2015-9525Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads - Amazon S3
≤2.1.3Update to 2.1.4
CVE-2015-9506Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads - Free Downloads
≤2.3.6Update to 2.3.7
CVE-2015-9514Apr 20, 2015
Medium6.1
Cross-Site Scripting
Two Factor Authentication
<1.1.10Update to 1.1.10
CVE-2015-9355Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads - Product Reviews
≤1.3.8Update to 1.3.10
CVE-2015-9526Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads - Wish Lists
≤1.1Update to 1.1.1
CVE-2015-9531Apr 20, 2015
Medium6.1
Cross-Site Scripting
Shoppette
<1.0.5Update to 1.0.5
CVE-2015-9535Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
TinyChat Room Spy
≤1.2.8Update to 1.2.9
CVE-2015-10110Apr 18, 2015
High7.5
Missing Access Controls
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤2.1.3Update to 2.1.4
CVE-2015-9337Apr 15, 2015
Medium5.3
Cross-Site Scripting
Contact Form by ContactMe.com
≤2.3No patch available
CVE-2014-4518Apr 15, 2015
Medium5.3
SQL Injection
WP Symposium
<15.4Update to 15.4
CVE-2015-3325Apr 14, 2015
Medium6.1
Cross-Site Scripting
My Wish List
<1.4.2Update to 1.4.2
CVE-2015-9493Apr 13, 2015
Critical9.8
Arbitrary File Upload
Website Contact Form With File Upload
≤1.3.4Update to 1.4
CVE-2015-10137Apr 12, 2015
Critical9.8
SQL Injection
cformsII
<14.6.10Update to 14.6.10
CVE-2015-9333Apr 11, 2015