CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1345)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8SQL Injection
YourMembers
≤3.0No patch available
- High8.8Command Injection
WP-DBManager
<2.72Update to 2.72
- High7.8OS Command Injection
WP-DBManager
<2.72Update to 2.72
- Medium6.5Arbitrary File Read
WP-DBManager
<2.7.2Update to 2.7.2
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Simple Sticky Footer
≤1.3.2Update to 1.3.3
- Medium6.1Cross-Site Scripting
Contact Form DB
≤2.8.19Update to 2.8.20
- Medium6.1Reflected Cross-Site Scripting
EWWW Image Optimizer
≤2.0.1Update to 2.0.2
- Medium6.1Reflected Cross-Site Scripting
Simple Calendar – Google Calendar, Events, & ICS Feeds
<2.0.4Update to 2.0.4
- Critical9.8Unspecified Vulnerability
enfold
<3.0.1Update to 3.0.1
- High8.8SQL Injection
BulletProof Security
<.51.1Update to .51.1
- Medium6.1Reflected Cross-Site Scripting
Titan Framework
<1.6Update to 1.6
- Medium5.31.3.10 - Multiple Cross-Site scripting
Contact Form 7 Integrations
1.0 – 1.3.10Update to 1.3.11
- Critical9.81.5.10 - Arbitrary File Upload
Infusionsoft Gravity Forms Add-on
1.5.3 – 1.5.10Update to 1.5.11
- Critical9.8SQL Injection
WP eCommerce
<3.8.7.6Update to 3.8.7.6
- High7.2Authenticated (Admin+) SQL Injection
Content Audit
<1.6.1Update to 1.6.1
- Low3.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.1.30Update to 1.1.31
- Medium6.1Stored Cross-Site Scripting
Subscribe2 – Form, Email Subscribers & Newsletters
<10.16Update to 10.16
- Medium4.8Cross-Site Scripting
BulletProof Security
<.52.5Update to .52.5
- High7.5Unauthenticated Arbitrary File Read
NativeChurch
≤1.6.1Update to 1.6.2
- Medium6.1Multiple Cross-Site Scripting
DZS Video Gallery
<7.95Update to 7.95
- Medium6.1Multiple Cross-Site Scripting
bSuite
≤5 alpha 2Update to 5 alpha 3
- Medium5.3Directory Traversal
Tom M8te
all versionsNo patch available
- High7.25.0.6 - Cross-Site Scripting
Easy Forms for Mailchimp
3.0 – 5.0.6Update to 5.0.7
- High8.8Arbitrary File Upload
Frontend File Manager Plugin
<3.6Update to 3.6
- Medium4.3Reflected Cross-Site Scripting
MaxButtons – Create buttons
<1.26.1Update to 1.26.1
- Critical9.8SQL Injection
I Recommend This – Love/Like Button for WordPress Posts
<3.7.3Update to 3.7.3
- High7.4Authenticated Access or Cross-Site Request Forgery leading to SQL Injection via orderby, order Parameters
All-In-One Security (AIOS) – Security and Firewall
<3.8.3Update to 3.8.3
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
I Recommend This – Love/Like Button for WordPress Posts
≤3.7.2Update to 3.7.3
- Medium6.3Cross-Site Request Forgery
MailPoet Newsletters (Previous)
<2.6.11Update to 2.6.11
- High7.3Authorization Bypass
MailPoet Newsletters (Previous)
≤2.6.7Update to 2.6.8