CWE-918Vulnerability type

WordPress SSRF vulnerabilities (page 1349)

Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SSRF vulnerabilities (page 1349)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting HK Exif Tags≤1.11Update to 1.12	CVE-2014-100007	—	Aug 1, 2014
Medium4.3	Cross-Site Request Forgery WordPress Related Posts<2.7.2Update to 2.7.2	CVE-2013-3476	—	Aug 1, 2014
High7.5	Local File Inclusion WP AmASIN – The Amazon Affiliate Shop≤0.9.6Update to 0.9.7	CVE-2014-4577	—	Aug 1, 2014
Medium6.1	Multiple Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!≤5.5.1Update to 5.5.2	CVE-2013-7477	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting WP-Table Reloaded≤1.9.3Update to 1.9.4	CVE-2013-1463	—	Aug 1, 2014
Medium5.3	Reflected Cross-Site Scripting Verification Code for Comments≤2.1.0No patch available	CVE-2014-4565	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting WPCB≤2.4.8No patch available	CVE-2014-4581	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Album and Image Gallery with Lightbox – Flagallery Photo Portfolio≤2.71Update to 2.72	CVE-2013-3261	—	Aug 1, 2014
Medium6.1	Multiple Cross-Site Scripting Pie Register – User Registration, Profiles & Content Restriction≤1.30Update to 1.31	CVE-2013-4954	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery to Cross-Site Scripting Contextual Related Posts≤1.8.6Update to 1.8.7	CVE-2013-2710	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Crowdsignal Dashboard – Polls, Surveys & more≤2.0.24Update to 2.0.25	CVE-2014-4856	—	Aug 1, 2014
Medium6.5	Cross-Site Request Forgery wp-html-sitemap≤1.2No patch available	CVE-2014-2675	—	Aug 1, 2014
Medium6.1	Reflected Cross Site Scripting WHOIS≤1.4.2.2Update to 1.4.2.3	CVE-2011-5194	—	Aug 1, 2014
Medium6.3	Cross-Site Request Forgery WordPress Content Slide≤1.4.2No patch available	CVE-2013-2708	—	Aug 1, 2014
Medium6.1	Open Redirection WP Symposium≤13.04Update to 13.05	CVE-2013-2694	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting via Search Parameter All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)≤2.0.3Update to 2.0.3.1	CVE-2013-5988	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Xhanch – My Twitter≤2.7.6Update to 2.7.7	CVE-2013-3253	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting BulletProof Security≤.48.9Update to .49	CVE-2013-3487	—	Aug 1, 2014
Medium4.3	Cross-Site Request Forgery Calendar≤1.3.2Update to 1.3.3	CVE-2013-2698	—	Aug 1, 2014
High7.3	Authentication Bypass Portable phpMyAdmin≤1.3.0Update to 1.3.1	CVE-2012-5469	—	Aug 1, 2014
High8.1	Unauthenticated Local File Inclusion Tinymce Thumbnail Gallery≤1.0.0Update to 1.1.0	CVE-2012-20002	—	Aug 1, 2014
High8.8	SQL Injection Mingle Forum<1.0.33Update to 1.0.33	CVE-2012-5328	—	Aug 1, 2014
High7.2	Stored Cross-Site Scripting PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links<1.6.3Update to 1.6.3	CVE-2013-1636	—	Aug 1, 2014
High8.8	Remote Code Execution WP Super Cache≤1.2Update to 1.3	CVE-2013-2009	—	Aug 1, 2014
High7.2	Cross-Site Scripting Wordfence Security – Firewall, Malware Scan, and Login Security≤5.1.3Update to 5.1.4	CVE-2014-4664	—	Jul 30, 2014
High8.8	Cross-Site Request Forgery WhyDoWork AdSense≤1.2No patch available	CVE-2014-9099	—	Jul 29, 2014
Medium6.1	Reflected Cross-Site Scripting WhyDoWork AdSense≤1.2No patch available	CVE-2014-9100	—	Jul 29, 2014
Critical9.8	SQL Injection Lead-Octopus-Power<1.1.1Update to 1.1.1	CVE-2014-5189	—	Jul 28, 2014
Critical9.8	SQL Injection fbgorillaall versionsNo patch available	CVE-2014-5200	—	Jul 28, 2014
Critical9.8	SQL Injection WORDPRESS VIDEO GALLERY<2.6Update to 2.6	CVE-2014-9097	—	Jul 24, 2014

Medium6.1
Cross-Site Scripting
HK Exif Tags
≤1.11Update to 1.12
CVE-2014-100007Aug 1, 2014
Medium4.3
Cross-Site Request Forgery
WordPress Related Posts
<2.7.2Update to 2.7.2
CVE-2013-3476Aug 1, 2014
High7.5
Local File Inclusion
WP AmASIN – The Amazon Affiliate Shop
≤0.9.6Update to 0.9.7
CVE-2014-4577Aug 1, 2014
Medium6.1
Multiple Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.5.1Update to 5.5.2
CVE-2013-7477Aug 1, 2014
Medium6.1
Cross-Site Scripting
WP-Table Reloaded
≤1.9.3Update to 1.9.4
CVE-2013-1463Aug 1, 2014
Medium5.3
Reflected Cross-Site Scripting
Verification Code for Comments
≤2.1.0No patch available
CVE-2014-4565Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
WPCB
≤2.4.8No patch available
CVE-2014-4581Aug 1, 2014
Medium6.1
Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.71Update to 2.72
CVE-2013-3261Aug 1, 2014
Medium6.1
Multiple Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤1.30Update to 1.31
CVE-2013-4954Aug 1, 2014
High8.8
Cross-Site Request Forgery to Cross-Site Scripting
Contextual Related Posts
≤1.8.6Update to 1.8.7
CVE-2013-2710Aug 1, 2014
Medium6.1
Cross-Site Scripting
Crowdsignal Dashboard – Polls, Surveys & more
≤2.0.24Update to 2.0.25
CVE-2014-4856Aug 1, 2014
Medium6.5
Cross-Site Request Forgery
wp-html-sitemap
≤1.2No patch available
CVE-2014-2675Aug 1, 2014
Medium6.1
Reflected Cross Site Scripting
WHOIS
≤1.4.2.2Update to 1.4.2.3
CVE-2011-5194Aug 1, 2014
Medium6.3
Cross-Site Request Forgery
WordPress Content Slide
≤1.4.2No patch available
CVE-2013-2708Aug 1, 2014
Medium6.1
Open Redirection
WP Symposium
≤13.04Update to 13.05
CVE-2013-2694Aug 1, 2014
Medium6.1
Cross-Site Scripting via Search Parameter
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤2.0.3Update to 2.0.3.1
CVE-2013-5988Aug 1, 2014
High8.8
Cross-Site Request Forgery
Xhanch – My Twitter
≤2.7.6Update to 2.7.7
CVE-2013-3253Aug 1, 2014
Medium6.1
Cross-Site Scripting
BulletProof Security
≤.48.9Update to .49
CVE-2013-3487Aug 1, 2014
Medium4.3
Cross-Site Request Forgery
Calendar
≤1.3.2Update to 1.3.3
CVE-2013-2698Aug 1, 2014
High7.3
Authentication Bypass
Portable phpMyAdmin
≤1.3.0Update to 1.3.1
CVE-2012-5469Aug 1, 2014
High8.1
Unauthenticated Local File Inclusion
Tinymce Thumbnail Gallery
≤1.0.0Update to 1.1.0
CVE-2012-20002Aug 1, 2014
High8.8
SQL Injection
Mingle Forum
<1.0.33Update to 1.0.33
CVE-2012-5328Aug 1, 2014
High7.2
Stored Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.6.3Update to 1.6.3
CVE-2013-1636Aug 1, 2014
High8.8
Remote Code Execution
WP Super Cache
≤1.2Update to 1.3
CVE-2013-2009Aug 1, 2014
High7.2
Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.1.3Update to 5.1.4
CVE-2014-4664Jul 30, 2014
High8.8
Cross-Site Request Forgery
WhyDoWork AdSense
≤1.2No patch available
CVE-2014-9099Jul 29, 2014
Medium6.1
Reflected Cross-Site Scripting
WhyDoWork AdSense
≤1.2No patch available
CVE-2014-9100Jul 29, 2014
Critical9.8
SQL Injection
Lead-Octopus-Power
<1.1.1Update to 1.1.1
CVE-2014-5189Jul 28, 2014
Critical9.8
SQL Injection
fbgorilla
all versionsNo patch available
CVE-2014-5200Jul 28, 2014
Critical9.8
SQL Injection
WORDPRESS VIDEO GALLERY
<2.6Update to 2.6
CVE-2014-9097Jul 24, 2014