CWE-918Vulnerability type

WordPress SSRF vulnerabilities (page 1352)

Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SSRF vulnerabilities (page 1352)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting DMCA WaterMarker<1.1Update to 1.1	CVE-2014-4520	—	May 28, 2014
Medium6.1	Cross-Site Scripting WP Easy Post Types<1.4.4Update to 1.4.4	CVE-2014-4524	—	May 28, 2014
High7.5	Directory Traversal Tera Charts≤0.1Update to 1.0	CVE-2014-4940	—	May 28, 2014
High8.8	Authenticated SQL Injection YAWPP (Yet Another WordPress Petition Plugin)≤1.2.1Update to 1.2.2	CVE-2014-5182	—	May 28, 2014
High8.8	SQL Injection quartz≤1.01.1No patch available	CVE-2014-5185	—	May 28, 2014
High7.1	Cross-Site Scripting Malware Finder≤1.1No patch available	CVE-2014-4538	—	May 28, 2014
Critical9.8	SQL Injection WP Rss Poster≤1.0.0No patch available	CVE-2014-4938	—	May 28, 2014
Medium6.1	Cross-Site Scripting BIC Media Widget≤1.0No patch available	CVE-2014-4516	—	May 28, 2014
Medium6.1	Cross-Site Scripting your-text-manager≤0.3.0No patch available	CVE-2014-4604	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting swipehq-payment-gateway-woocommerce≤2.7.1No patch available	CVE-2014-4558	—	May 28, 2014
Medium6.1	Cross-Site Scripting wppm≤1.6.4.bNo patch available	CVE-2014-4593	—	May 28, 2014
High7.1	Cross-Site Scripting Oleggo LiveStream≤0.2.6No patch available	CVE-2014-4540	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting Conversador≤2.61No patch available	CVE-2014-4519	—	May 28, 2014
Medium6.1	Cross-Site Scripting Rezgo Online Booking<1.4.3Update to 1.4.3	CVE-2014-4546	—	May 28, 2014
Medium6.1	Cross-Site Scripting Validated≤1.0.2Update to 2.0.0	CVE-2014-4564	—	May 28, 2014
Medium6.1	Cross-Site Scripting Jigoshop Swipe plugin≤3.1.0No patch available	CVE-2014-4557	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting ActiveHelper LiveHelp Live Chat<3.1.5Update to 3.1.5	CVE-2014-4513	—	May 28, 2014
Medium6.1	Cross-Site Scripting OMFG Mobile Pro≤1.1.26No patch available	CVE-2014-4541	—	May 28, 2014
Medium6.1	Unauthenticated Cross-Site Scripting Easy Career Openings≤0.4No patch available	CVE-2014-4523	—	May 28, 2014
Medium5.3	Sensitive Information Disclosure WP EasyCart: Shopping Cart and eCommerce Store≤2.0.5Update to 2.0.6	CVE-2014-4942	—	May 28, 2014
Medium6.1	Cross-Site Scripting Podcast Channels<0.21Update to 0.21	CVE-2014-4544	—	May 28, 2014
Medium6.1	Cross-Site Scripting ZdStatistics≤2.0.1No patch available	CVE-2014-4605	—	May 28, 2014
Medium6.1	Cross-Site Scripting Bugs Go Viral : Facebook Promotion Generator≤1.3.4No patch available	CVE-2014-4528	—	May 28, 2014
Medium6.1	Cross-Site Scripting WP-Contact≤1.0No patch available	CVE-2014-4583	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting ooorl≤1.0.0No patch available	CVE-2014-4542	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting dsSearchAgent: WordPress Edition<1.0-beta10No patch available	CVE-2014-4522	—	May 25, 2014
Medium6.1	Cross-Site Scripting WordPress Social Login≤2.1.5Update to 2.1.6	CVE-2014-4576	—	May 25, 2014
Medium6.1	Cross-Site Scripting proquoter≤1.0No patch available	CVE-2014-4545	—	May 25, 2014
Medium6.1	CBI Referral Manager <= 1.2.1 Cross-Site Scripting CBI Referral Manager≤1.2.1No patch available	CVE-2014-4517	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting Local Weather≤1.0No patch available	CVE-2014-4561	—	May 25, 2014

Medium6.1
Cross-Site Scripting
DMCA WaterMarker
<1.1Update to 1.1
CVE-2014-4520May 28, 2014
Medium6.1
Cross-Site Scripting
WP Easy Post Types
<1.4.4Update to 1.4.4
CVE-2014-4524May 28, 2014
High7.5
Directory Traversal
Tera Charts
≤0.1Update to 1.0
CVE-2014-4940May 28, 2014
High8.8
Authenticated SQL Injection
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.1Update to 1.2.2
CVE-2014-5182May 28, 2014
High8.8
SQL Injection
quartz
≤1.01.1No patch available
CVE-2014-5185May 28, 2014
High7.1
Cross-Site Scripting
Malware Finder
≤1.1No patch available
CVE-2014-4538May 28, 2014
Critical9.8
SQL Injection
WP Rss Poster
≤1.0.0No patch available
CVE-2014-4938May 28, 2014
Medium6.1
Cross-Site Scripting
BIC Media Widget
≤1.0No patch available
CVE-2014-4516May 28, 2014
Medium6.1
Cross-Site Scripting
your-text-manager
≤0.3.0No patch available
CVE-2014-4604May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
swipehq-payment-gateway-woocommerce
≤2.7.1No patch available
CVE-2014-4558May 28, 2014
Medium6.1
Cross-Site Scripting
wppm
≤1.6.4.bNo patch available
CVE-2014-4593May 28, 2014
High7.1
Cross-Site Scripting
Oleggo LiveStream
≤0.2.6No patch available
CVE-2014-4540May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
Conversador
≤2.61No patch available
CVE-2014-4519May 28, 2014
Medium6.1
Cross-Site Scripting
Rezgo Online Booking
<1.4.3Update to 1.4.3
CVE-2014-4546May 28, 2014
Medium6.1
Cross-Site Scripting
Validated
≤1.0.2Update to 2.0.0
CVE-2014-4564May 28, 2014
Medium6.1
Cross-Site Scripting
Jigoshop Swipe plugin
≤3.1.0No patch available
CVE-2014-4557May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
CVE-2014-4513May 28, 2014
Medium6.1
Cross-Site Scripting
OMFG Mobile Pro
≤1.1.26No patch available
CVE-2014-4541May 28, 2014
Medium6.1
Unauthenticated Cross-Site Scripting
Easy Career Openings
≤0.4No patch available
CVE-2014-4523May 28, 2014
Medium5.3
Sensitive Information Disclosure
WP EasyCart: Shopping Cart and eCommerce Store
≤2.0.5Update to 2.0.6
CVE-2014-4942May 28, 2014
Medium6.1
Cross-Site Scripting
Podcast Channels
<0.21Update to 0.21
CVE-2014-4544May 28, 2014
Medium6.1
Cross-Site Scripting
ZdStatistics
≤2.0.1No patch available
CVE-2014-4605May 28, 2014
Medium6.1
Cross-Site Scripting
Bugs Go Viral : Facebook Promotion Generator
≤1.3.4No patch available
CVE-2014-4528May 28, 2014
Medium6.1
Cross-Site Scripting
WP-Contact
≤1.0No patch available
CVE-2014-4583May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
ooorl
≤1.0.0No patch available
CVE-2014-4542May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
dsSearchAgent: WordPress Edition
<1.0-beta10No patch available
CVE-2014-4522May 25, 2014
Medium6.1
Cross-Site Scripting
WordPress Social Login
≤2.1.5Update to 2.1.6
CVE-2014-4576May 25, 2014
Medium6.1
Cross-Site Scripting
proquoter
≤1.0No patch available
CVE-2014-4545May 25, 2014
Medium6.1
CBI Referral Manager <= 1.2.1 Cross-Site Scripting
CBI Referral Manager
≤1.2.1No patch available
CVE-2014-4517May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
Local Weather
≤1.0No patch available
CVE-2014-4561May 25, 2014