CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1363)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.2 | Cross-Site Scripting | CVE-2012-2400 | — | |
| Medium6.5 | Same Origin Policy Bypass | CVE-2012-2401 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2012-2403 | — | |
| Critical9.8 | Multiple Vulnerabilities | CVE-2012-4033 | — | |
| High7.5 | Path Disclosure | CVE-2012-6512 | — | |
| High7.1 | Cross-Site Scripting | CVE-2012-1835 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10019 | — | |
| High7.2 | Arbitrary File Upload | CVE-2012-4874 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-5913 | — | |
| Critical9.8 | 1.5-1.5.4 - SQL Injection | CVE-2012-2109 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-1834 | — | |
| High8.3 | Server Side Request Forgery to Cross-Site Scirpting | CVE-2012-10018 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2012-5318 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3576 | — | |
| High7.2 | Remote Code Execution | CVE-2012-1785 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2012-1786 | — | |
| High7.2 | Cross-Site Scripting | CVE-2011-5082 | — | |
| High8.8 | SQL Injection | CVE-2012-10009 | — | |
| High7.1 | Cross-Site Scripting | CVE-2012-5229 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2012-0934 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-1125 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-1011 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-1010 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2012-5325 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6527 | — | |
| Medium5.3 | Directory Traversal | CVE-2012-0898 | — | |
| High7.5 | Arbitrary File Download | CVE-2012-0896 | — | |
| Medium6.1 | Open Redirect | CVE-2012-6499 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-0901 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2012-5350 | — |
- High7.2Cross-Site Scripting
WordPress
≤3.3.1Update to 3.3.2
- Medium6.5Same Origin Policy Bypass
WordPress
<3.3.2Update to 3.3.2
- Medium6.4Cross-Site Scripting
WordPress
≤3.3.1Update to 3.3.2
- Critical9.8Multiple Vulnerabilities
zingiri-web-shop
<2.4.0Update to 2.4.0
- High7.5Path Disclosure
Organizer
≤1.2.1No patch available
- High7.1Cross-Site Scripting
Timely All-in-One Events Calendar
<1.6Update to 1.6
- Critical9.8Arbitrary File Upload
Front-end Editor
<2.3Update to 2.3
- High7.2Arbitrary File Upload
AWP Classifieds
<2.0Update to 2.0
- Medium6.1Cross-Site Scripting
WordPress Integrator
≤1.32No patch available
- Critical9.81.5-1.5.4 - SQL Injection
BuddyPress
1.5 – 1.5.4Update to 1.5.5
- Medium6.1Cross-Site Scripting
CMS Tree Page View – Reorder Pages with a Drag-and-Drop Tree
<0.8.9Update to 0.8.9
- High8.3Server Side Request Forgery to Cross-Site Scirpting
Mapplic Lite
<1.0.1Update to 1.0.1
- Critical9.8Unauthenticated Arbitrary File Upload
Kish Guest Posting
≤1.2No patch available
- Critical9.8Arbitrary File Upload
IDB Ecommerce (wpStoreCart 5)
≤2.5.29Update to 2.5.30
- High7.2Remote Code Execution
Videopack
<2.0Update to 2.0
- Medium5.3Full Path Disclosure
Videopack
≤1.1Update to 2.0
- High7.2Cross-Site Scripting
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
<111220Update to 111220
- High8.8SQL Injection
404Like
≤1.0Update to 1.0.2
- High7.1Cross-Site Scripting
Slideshow Gallery
≤1.1.4No patch available
- Critical9.8Remote File Inclusion
Theme Tuner
<0.8Update to 0.8
- Critical9.8Arbitrary File Upload
Kish Guest Posting
<1.2Update to 1.2
- Critical9.8Arbitrary File Upload
AllWebMenus WordPress Menu Plugin
≤1.1.8Update to 1.1.9
- Critical9.8Arbitrary File Upload
AllWebMenus WordPress Menu Plugin
<1.1.9Update to 1.1.9
- Medium5.4Cross-Site Scripting
Shortcode Redirect
≤1.0.01Update to 1.0.02
- Medium6.1Cross-Site Scripting
My Calendar – Accessible Event Manager
<1.10.5Update to 1.10.5
- Medium5.3Directory Traversal
myEASYbackup
<1.0.9Update to 1.0.9
- High7.5Arbitrary File Download
Count per Day
≤3.1Update to 3.1.1
- Medium6.1Open Redirect
Age Verification
≤0.4Update to 0.5
- Medium6.1Cross-Site Scripting
YouSayToo auto-publishing plugin
≤1.0No patch available
- High8.8Authenticated SQL Injection
Pay With Tweet
≤1.1Update to 1.2