CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 138)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Unauthorized B2B Group Assignment
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More
<5.2.40Update to 5.2.40
- Medium6.53.3.9.1 - Authenticated (Author+) Arbitrary File Read
Pods – Custom Content Types and Fields
3.3 – 3.3.9.1Update to 3.3.9.2
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters
Custom Contact Forms
≤7.16Update to 7.16.1
- Medium5.4Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.3.3Update to 7.3.4
- Medium4.3Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook
Ninja Forms - Save Progress
≤3.0.30Update to 3.0.31
- High8.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Abandoned Cart Pro for WooCommerce
≤10.7.1Update to 10.7.2
- Medium5.3Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
<3.13.0Update to 3.13.0
- Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.60Update to 2.1.70
- High8.8Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover
Nokri – Job Board WordPress Theme
≤1.6.4Update to 1.6.6
- Medium4.3Booking Accommodation WordPress Theme < 3.16.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
WP Rentals - Booking Accommodation WordPress Theme
<3.16.0Update to 3.16.0
- Medium5.3Missing Authorization
JetPopup
≤2.0.20.2Update to 2.0.20.3
- Medium6.53.15.1 - Unauthenticated Arbitrary Shortcode Execution
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
3.14.10 – 3.15.1Update to 3.15.2
- Critical9.8Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
Divi Ajax Filter
≤5.1.2Update to 5.1.3
- High8.1Unauthenticated PHP Object Injection
JobSearch WP Job Board
≤3.2.0No patch available
- High7.5Unauthenticated Arbitrary File Read
Shared Files Pro
<1.7.70Update to 1.7.70
- High7.2Responsive Multi-Purpose Theme <= 8.0 - Unauthenticated Stored Cross-Site Scripting
enfold
≤8.0Update to 8.1
- Medium5.34.6.3 - Unauthenticated Paid API Consumption and Database Row Injection
EmbedPress
4.6.0 – 4.6.3Update to 4.6.4
- Medium5.3Unauthenticated Email Header Injection
JetFormBuilder — Dynamic Blocks Form Builder
<3.6.5.2Update to 3.6.5.2
- Critical9.8Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
<3.6.5.2Update to 3.6.5.2
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
SEOPress – AI SEO Plugin & On-site SEO
≤10.1Update to 10.2
- High8.1Unauthenticated PHP Object Injection
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.0Update to 1.31.1
- Medium5.3Missing Authorization
Pre-Orders for WooCommerce
≤2.3.1Update to 2.3.2
- Medium6.1Unauthenticated Open Redirect
Accept Stripe Payments
<2.1.4Update to 2.1.4
- High7.21.8.4 - Unauthenticated Stored Cross-Site Scripting
FAQ Builder AYS
1.6.3 – 1.8.4Update to 1.8.5
- Medium5.3Missing Authorization
Quick Event Manager
≤9.18Update to 9.19
- Medium5.3Missing Authorization
Timetics – Appointment Booking Calendar & Scheduling
≤1.0.61Update to 1.0.62
- Medium4.42.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Joli Table Of Contents – Table of Contents with Gutenberg Block & Shortcode
2.0.0 – 2.8.0Update to 2.8.1
- Medium5.3Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.12.13Update to 3.13.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.5Update to 2.12.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Quick Event Manager
≤9.18Update to 9.19