CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1348)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium4.7 | Cross-Site Request Forgery | CVE-2013-2705 | — | |
| High8.8 | SQL Injection | CVE-2012-5327 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-3476 | — | |
| Medium5.3 | Reflected Cross-Site Scripting | CVE-2014-4565 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3261 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-4954 | — | |
| High7.5 | Local File Inclusion | CVE-2014-4577 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-3923 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-10378 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-0895 | — | |
| Critical9.8 | Remote Code Execution | CVE-2013-2010 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-7477 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4856 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1463 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4581 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2013-2710 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100007 | — | |
| Medium5.3 | Cross-Site Scripting | CVE-2011-5128 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4854 | — | |
| Critical9.8 | Local/Remote File Inclusion | CVE-2013-7483 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2699 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-2287 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2013-10026 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3256 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2014-4725 | — | |
| Critical9.8 | Remote Code Execution | CVE-2013-2011 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2013-0721 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6342 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4578 | — | |
| Medium6.1 | Cross-Site scripting | CVE-2014-4588 | — |
- Medium4.7Cross-Site Request Forgery
Simple Shopping Cart
<3.6Update to 3.6
- High8.8SQL Injection
Mingle Forum
≤1.0.32.1Update to 1.0.33
- Medium4.3Cross-Site Request Forgery
WordPress Related Posts
<2.7.2Update to 2.7.2
- Medium5.3Reflected Cross-Site Scripting
Verification Code for Comments
≤2.1.0No patch available
- Medium6.1Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.71Update to 2.72
- Medium6.1Multiple Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤1.30Update to 1.31
- High7.5Local File Inclusion
WP AmASIN – The Amazon Affiliate Shop
≤0.9.6Update to 0.9.7
- Medium6.1Reflected Cross-Site Scripting
DZS Video Gallery
<7.95Update to 7.95
- Medium6.1Cross-Site Scripting
Yoast Duplicate Post
≤2.6Update to 3.0
- Medium6.1Cross-Site Scripting
Count per Day
≤3.1Update to 3.1.1
- Critical9.8Remote Code Execution
W3 Total Cache
≤0.9.2.8Update to 0.9.2.9
- Medium6.1Multiple Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.5.1Update to 5.5.2
- Medium6.1Cross-Site Scripting
Crowdsignal Dashboard – Polls, Surveys & more
≤2.0.24Update to 2.0.25
- Medium6.1Cross-Site Scripting
WP-Table Reloaded
≤1.9.3Update to 1.9.4
- Medium6.1Reflected Cross-Site Scripting
WPCB
≤2.4.8No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Contextual Related Posts
≤1.8.6Update to 1.8.7
- Medium6.1Cross-Site Scripting
HK Exif Tags
≤1.11Update to 1.12
- Medium5.3Cross-Site Scripting
Adminimize
<1.7.22Update to 1.7.22
- Medium6.1Cross-Site Scripting
WP Construction Mode
≤1.8Update to 1.9
- Critical9.8Local/Remote File Inclusion
SlideDeck 2 Lite Responsive Content Slider
≤2.3.3Update to 2.3.5
- High8.8Cross-Site Request Forgery
underConstruction
<1.09Update to 1.09
- Medium6.1Multiple Cross-Site Scripting
Uploader
≤1.0.4No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Mail Subscribe List
≤2.0.9Update to 2.1
- High8.8Cross-Site Request Forgery
sexybookmarks
≤6.1.4.0Update to 6.1.5.0
- Critical9.8Arbitrary File Upload
MailPoet Newsletters (Previous)
≤2.6.6Update to 2.6.7
- Critical9.8Remote Code Execution
WP Super Cache
<1.3.2Update to 1.3.2
- Medium5.3Full Path Disclosure
WP PHP widget
≤1.0.2No patch available
- Medium6.1Cross-Site Scripting
Tweet Blender
≤4.0.1Update to 4.0.2
- Medium6.1Reflected Cross-Site Scripting
WP App Maker
≤1.0.16.4No patch available
- Medium6.1Cross-Site scripting
Hot Files: File Sharing and Download Manager Plugin
≤1.0.0No patch available