CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 1371)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.4 | Cross-Site Scripting | CVE-2007-4893 | — | |
| High8.8 | Arbitrary File Upload | CVE-2007-3544 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2007-4014 | — | |
| High7.2 | Cross-Site Scripting | CVE-2007-4104 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-2627 | — | |
| High8.8 | SQL Injection | CVE-2007-3140 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2007-3288 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-3241 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-3240 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-3239 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-4166 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2007-2828 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-2714 | — | |
| Critical9.8 | Directory Traversal and File Inclusion | CVE-2007-2482 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2007-2485 | — | |
| Critical9.8 | Local File Inclusion | CVE-2007-2483 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2007-2481 | — | |
| Critical9.8 | SQL Injection | CVE-2007-10003 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2007-2426 | — | |
| High8.8 | SQL Injection | CVE-2007-1897 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-1622 | — | |
| Medium6.1 | Open Redirect | CVE-2007-1599 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2007-1894 | — | |
| High7.2 | Cross-Site Scripting | CVE-2008-0192 | — | |
| Medium4.3 | Authorization Bypass | CVE-2007-1893 | — | |
| Critical9.8 | Backdoor | CVE-2007-1277 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2007-1244 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2007-1230 | — | |
| High7.2 | Cross-Site Scripting | CVE-2007-1049 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2011-0700 | — |
- Medium6.4Cross-Site Scripting
WordPress
≤2.2.2Update to 2.2.3
- High8.8Arbitrary File Upload
WordPress
≤2.2.1Update to 2.2.2
- Medium6.1Reflected Cross-Site Scripting
Blix
≤0.9.1No patch available
- High7.2Cross-Site Scripting
FeedStats
<2.4Update to 2.4
- Medium6.1Cross-Site Scripting
WordPress
≤2.2Update to 2.2.1
- High8.8SQL Injection
WordPress
≤2.2Update to 2.2.1
- High7.2Stored Cross-Site Scripting
stats
≤1.0Update to 1.1
- Medium6.1Cross-Site Scripting
Cordobo Green Park
all versionsNo patch available
- Medium6.1Cross-Site Scripting
Vistered Little
all versionsNo patch available
- Medium6.1Cross-Site Scripting
andyblue
<1.5Update to 1.5
- Medium6.1Cross-Site Scripting
Unnamed
≤1.2.17Update to 1.2.17.1
- High8.8Cross-Site Request Forgery
AdSense-Deluxe
≤0.8No patch available
- Medium6.1Cross-Site Scripting
Akismet Anti-spam: Spam Protection
≤2.0.1Update to 2.0.2
- Critical9.8Directory Traversal and File Inclusion
wordTube
≤1.43Update to 1.44
- Critical9.8Remote File Inclusion
Myflash
≤1.00Update to 1.11
- Critical9.8Local File Inclusion
WP-Table
≤1.43Update to 1.44
- Critical9.8Remote File Inclusion
wordTube
≤1.43Update to 1.44
- Critical9.8SQL Injection
The Hacker's Diet
≤0.9.6bUpdate to 0.9.7b
- Critical9.8Remote File Inclusion
MySliderGallery
≤1.2.1Update to 1.4b5
- High8.8SQL Injection
WordPress
<2.1.3Update to 2.1.3
- Medium6.1Cross-Site Scripting
WordPress
≤2.1.1Update to 2.0.10 or 2.1.2
- Medium6.1Open Redirect
WordPress
<2.0.10Update to 2.0.10
- Medium6.4Cross-Site Scripting
WordPress
≤2.1.2Update to 2.0.10 or 2.1.3
- High7.2Cross-Site Scripting
WordPress
≤2.0.9Update to 2.0.10
- Medium4.3Authorization Bypass
WordPress
≤2.1.2Update to 2.1.3
- Critical9.8Backdoor
WordPress
2.2.1 – 2.2.1Update to 2.2.2
- Medium6.4Cross-Site Scripting
WordPress
≤2.1.1Update to 2.1.2
- Medium6.4Cross-Site Scripting
WordPress
≤2.1.1Update to 2.1.2
- High7.2Cross-Site Scripting
WordPress
≤2.1Update to 2.0.9 or 2.1.1
- Medium6.4Cross-Site Scripting
WordPress
≤3.0.4Update to 3.0.5