CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1338)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Arbitrary File Upload/Deletion
Easy Digital Downloads – Upload File
≤1.0.3Update to 1.0.4
- Medium6.4Cross-Site Scripting via example.html
WordPress
≤4.2.1Update to 3.7.8 or 3.8.8 or 3.9.6 or 4.0.5 or 4.1.5 or 4.2.2
- High8.8TheCartPress eCommerce Shopping Cart <= 1.5.3.6 Cross-Site Request Forgery
TheCartPress eCommerce Shopping Cart
≤1.5.3.6No patch available
- Medium5.4Authenticated (Subscriber+) Cross-Site Scripting
Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic
<7.6.1.0Update to 7.6.1.0
- High7.5Arbitrary File Download
Aspose Importer & Exporter (Discontinued)
≤2.0Update to 3.0
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<3.9.1Update to 3.9.1
- Critical10.0Multiple SQL Injections
Simple Ads Manager
<2.7.97Update to 2.7.97
- Medium5.3Information Disclosure
Simple Ads Manager
≤2.5.96Update to 2.5.97
- Critical9.8SQL Injection
WP Business Intelligence Lite
≤1.6.2Update to 1.6.3
- Critical9.8Arbitrary File Upload
Simple Ads Manager
≤2.5.94Update to 2.5.96
- High7.1Reflected Cross-Site Scripting
Favicon by RealFaviconGenerator
<1.2.13Update to 1.2.13
- Medium5.3Information Disclosure
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
<2.2.6Update to 2.2.6
- High7.5Arbitrary File Download
Aspose.PDF Exporter
<2.0Update to 2.0
- Critical9.8Arbitrary File Upload
VideoWhisper Video Presentation
≤4.1.4Update to 4.6.1
- Critical9.8Unrestricted File Upload leading to Remote Code Execuction
Webcam Video Conference
≤4.91.8Update to 4.91.9
- High7.5Unauthenticated Arbitrary File Read
Aspose.Words – Import and Export word documents
≤1.0Update to 2.0
- High7.1Cross-Site Scripting
flashy
≤1.3No patch available
- High8.8Arbitrary File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<2.0.77.3Update to 2.0.77.3
- High8.8Cross-Site Request Forgery
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<2.0.77.3Update to 2.0.77.3
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
AB Google Map Travel (AB-MAP)
<4.0Update to 4.0
- High8.8Arbitrary File Download
WP Marketplace – Complete Shopping Cart / eCommerce Solution
<2.4.1Update to 2.4.1
- Medium6.5Path Traversal
WP Marketplace – Complete Shopping Cart / eCommerce Solution
<2.4.1Update to 2.4.1
- Critical9.1SQL Injection
Gravity Forms
≤1.9.3.5Update to 1.9.3.6
- Critical9.8Arbitrary File Upload
ReFlex Gallery » WordPress Photo Gallery
<3.1.4Update to 3.1.4
- Critical9.8Arbitrary File Upload
Work The Flow File Upload
≤2.5.2Update to 2.5.3
- Medium5.4Authenticated Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.13Update to 1.2.13
- High7.2Stored Cross-Site Scripting
WooCommerce
<2.3.6Update to 2.3.6
- High7.2Authenticated (Admin+) SQL Injection
Responsive Slider – Image Slider – Slideshow for WordPress
<2.7.0Update to 2.7.0
- Critical9.8SQL Injection
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.2.5Update to 3.2.5
- Critical9.8SQL Injection
Contact Form, Drag and Drop Form Builder Plugin – Live Forms
<3.2.0Update to 3.2.0