CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 40)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Payment Bypass
Payex Payment Gateway for Woocommerce
≤1.2.10No patch available
- Medium5.3Unauthenticated Payment Bypass
Payment Integration Wompi
≤4.0.1No patch available
- High8.8Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
≤2.17.0Update to 2.18.0
- Medium5.3Missing Authorization
Mintpay for WooCommerce
≤2.2.3No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Advanced Custom Fields: Extended
0.9.2.7 – 0.9.2.7Update to 0.9.2.8
- Critical9.8Unauthenticated Remote Code Execution
Advanced Custom Fields: Extended
<0.9.2.8Update to 0.9.2.8
- Medium6.40.9.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Advanced Custom Fields: Extended
0.8.9.4 – 0.9.2.7Update to 0.9.2.8
- High7.3Unauthenticated Arbitrary Non-Admin Account Takeover
Advanced Custom Fields: Extended
0.9.2.7 – 0.9.2.7Update to 0.9.2.8
- Medium4.3Missing Authorization
LiteSpeed Cache
<7.9.2Update to 7.9.2
- High7.2Authenticated (Multisite Subsite Admin+) Arbitrary Code Execution
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.5.17Update to 5.0.0
- High7.3Unauthenticated Privilege Escalation
Datawiza Proxy Auth Plugin – SSO
≤1.1.0Update to 1.1.1
- Medium6.3Authenticated (Contributor+) Arbitrary HTML Injection
Qi Addons For Elementor
≤1.11.1Update to 1.11.2
- Medium4.3Missing Authorization
InstaWP Connect – 1-click WP Staging & Migration
≤0.1.4.1Update to 0.1.4.2
- Medium4.39.0.2 - Authenticated (Contributor+) Insecure Direct Object Reference
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress
8.3.0 – 9.0.2Update to 9.0.3
- Medium4.39.1.2 - Missing Authorization
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress
8.5.55 – 9.1.2Update to 9.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
LiteSpeed Cache
<7.9.2Update to 7.9.2
- High7.2Unauthenticated Stored Cross-Site Scripting
LiteSpeed Cache
<7.9.2Update to 7.9.2
- High7.24.8.1 - Authenticated (Editor+) Arbitrary File Upload
Depicter — Popup & Slider Builder
4.0.5 – 4.8.1Update to 4.8.2
- Medium5.3Missing Authorization
Popup Builder – Create highly converting, mobile friendly marketing popups.
<4.4.6Update to 4.4.6
- Low2.7Missing Authorization
Download Monitor
<5.3.5Update to 5.3.5
- Medium4.3Missing Authorization
GiveWP – Donation Plugin and Fundraising Platform
≤4.19.0.0Update to 4.19.0.1
- Medium4.3Missing Authorization
GiveWP – Donation Plugin and Fundraising Platform
≤4.19.0.0Update to 4.19.0.1
- Medium5.3Unauthenticated Donation Amount Restriction Bypass
GiveWP – Donation Plugin and Fundraising Platform
≤4.19.0.0Update to 4.19.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<4.0.5Update to 4.0.5
- Low2.7Missing Authorization
Essential Addons for Elementor – Popular Elementor Templates & Widgets
<6.8.7Update to 6.8.7
- Medium5.3Unauthenticated Payment Bypass
WP Stripe Checkout
≤1.2.2.61Update to 1.2.2.62
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
HIPAA Forms
<3.3.2Update to 3.3.2
- Medium5.3Unauthenticated Payment Bypass
OPay Payment Gateway for WooCommerce
≤2.5.5No patch available
- Medium5.3Unauthenticated Payment Bypass
Payment Gateway – nexi Alpha Bank for WooCommerce
<2.2.1Update to 2.2.1
- Medium5.3Missing Authorization
CCAvenue Payment Gateway for WooCommerce
≤3.1No patch available