CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1351)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4582 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4568 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4570 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4548 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2014-4595 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4573 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4591 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4575 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4585 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-4163 | — | |
| Medium4.3 | Cross-Site Request Forgery leading to player deletion | CVE-2014-4030 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3850 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-5345 | — | |
| Critical9.8 | SQL Injection | CVE-2014-3961 | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-3921 | — | |
| High7.5 | Path Traversal | CVE-2014-4941 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4564 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4541 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4519 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4557 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4546 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4513 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2014-4942 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2014-4523 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4540 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4593 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4554 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2014-5186 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2014-9292 | — | |
| High7.2 | SQL Injection | CVE-2014-5184 | — |
- Medium6.1Reflected Cross-Site Scripting
WP Consultant
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Webcam Microphone Screen Recorder – Media Capture
≤1.55.4Update to 1.55.5
- Medium6.1Reflected Cross-Site Scripting
VideoWhisper Video Presentation
≤3.25Update to 3.31
- Medium6.1Reflected Cross-Site Scripting
Ruven Toolkit
≤2.0No patch available
- Medium6.1Multiple Cross-Site Scripting
wp-restful
≤0.1No patch available
- High7.1Cross-Site Scripting
Walk Score Plugin
≤0.5.5No patch available
- Medium6.1Reflected Cross-Site Scripting
WP-Picasa-Image
≤1.0No patch available
- Medium6.1Cross-Site Scripting
WikiPop
≤2.0No patch available
- Medium6.1Cross-Site Scripting
WP-FaceThumb
≤1.0No patch available
- High8.8Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
- Medium4.3Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
- Medium6.1Cross-Site Scripting
Member Approval
≤131109No patch available
- Medium6.1Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
- Critical9.8SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
- High7.2Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
- High7.5Path Traversal
Cross-RSS
≤1.7No patch available
- Medium6.1Cross-Site Scripting
Validated
≤1.0.2Update to 2.0.0
- Medium6.1Cross-Site Scripting
OMFG Mobile Pro
≤1.1.26No patch available
- Medium6.1Reflected Cross-Site Scripting
Conversador
≤2.61No patch available
- Medium6.1Cross-Site Scripting
Jigoshop Swipe plugin
≤3.1.0No patch available
- Medium6.1Cross-Site Scripting
Rezgo Online Booking
<1.4.3Update to 1.4.3
- Medium6.1Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
- Medium5.3Sensitive Information Disclosure
WP EasyCart: Shopping Cart and eCommerce Store
≤2.0.5Update to 2.0.6
- Medium6.1Unauthenticated Cross-Site Scripting
Easy Career Openings
≤0.4No patch available
- High7.1Cross-Site Scripting
Oleggo LiveStream
≤0.2.6No patch available
- Medium6.1Cross-Site Scripting
wppm
≤1.6.4.bNo patch available
- Medium6.1Cross-Site Scripting
SS Downloads
≤1.4.4.1Update to 1.5
- High7.2Authenticated SQL Injection
All Video Gallery Plugin for WordPress
≤1.2No patch available
- High7.5Server-Side Request Forgery
jRSS Widget
≤1.2No patch available
- High7.2SQL Injection
stripshow
≤2.5.2No patch available