CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 140)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.7.7Update to 2.7.8
- High7.5Unauthenticated SQL Injection
VikAppointments Services Booking Calendar
≤1.2.20Update to 1.2.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
Divi
≤4.27.6Update to 4.27.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
≤2.4.4Update to 2.4.5
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
<2.7.2.1Update to 2.7.2.1
- Medium6.5Authenticated (Administrator+) Arbitrary File Deletion
WPvivid — Backup, Migration & Staging
<0.9.134Update to 0.9.134
- Medium5.3Unauthenticated Insecure Direct Object Reference
PublishPress Permissions: Access Control, Content Permissions, User Access
≤4.8.3Update to 4.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery PhotoBlocks
≤1.3.4Update to 1.3.5
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.11.11Update to 2.12.0
- Medium6.4Authenticated (Contributor +) Stored Cross-Site Scripting
SEO WRITING – AI Writer for SEO & AI Search
≤1.12.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.27Update to 2.15.28
- High7.2Unauthenticated Stored Cross-Site Scripting
EWWW Image Optimizer
≤8.7.6Update to 8.7.7
- Medium5.3Missing Authorization
RentSyst – CRM solution for fleet management
≤2.1.3No patch available
- Low3.13.15.1 - Authenticated (Custom Role+) Information Exposure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
3.14.0 – 3.15.1Update to 3.15.2
- High7.5Unauthenticated Denial of Service
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤10.1.08Update to 10.1.09
- Medium5.3Unauthenticated Price Manipulation
E-cab Taxi Booking Manager for Woocommerce
<2.0.5Update to 2.0.5
- Medium4.3Cross-Site Request Forgery
Simply Schedule Appointments
≤1.6.12.23Update to 1.6.12.24
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium4.3Cross-Site Request Forgery
Activity Log – Monitor User and Agent Changes
≤2.13.1Update to 2.14.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Estatik Real Estate Plugin
≤4.3.4No patch available
- High7.2Authenticated (Administrator+) Arbitrary File Upload
WPvivid — Backup, Migration & Staging
<0.9.134Update to 0.9.134
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.11Update to 14.16.12
- Medium5.3Unauthenticated Information Exposure
FormLayer
<1.0.9Update to 1.0.9
- Medium5.3Unauthenticated Information Exposure
Xpro Addons — 150+ Widgets for Elementor
<1.7.8Update to 1.7.8
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.0Update to 6.1.1
- Medium5.3Unauthenticated Information Exposure
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium5.3Missing Authorization
Ultimate Gift Cards for WooCommerce
≤3.2.9Update to 3.2.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Social Media Share Buttons & Social Sharing Icons
<3.0.1Update to 3.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Payment
≤2.5.1Update to 2.5.2
- Medium5.5Authenticated (Editor+) Server-Side Request Forgery
Broken Link Checker
≤2.4.14Update to 2.4.14.1