CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 49)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Contributor+) Arbitrary File Upload
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.16.1Update to 8.16.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
Easy Property Listings
≤3.5.26Update to 3.5.27
- Medium5.3Unauthenticated Information Exposure
Easy Property Listings
≤3.5.27Update to 3.5.28
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.16.1Update to 8.16.2
- Medium5.4Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.6.28Update to 1.6.29
- High7.2Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header
European VAT Compliance Assistant for WooCommerce
≤1.36.10Update to 1.36.11
- High7.2Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.61Update to 2.8.62
- Medium6.4Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter
YMC Filter
≤3.12.19Update to 3.12.20
- Medium4.3Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
Tutor LMS – eLearning and online course solution
≤4.1.0Update to 4.1.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action
News Kit Addons For Elementor
≤1.4.8Update to 1.4.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN
≤1.4.2Update to 1.4.3
- Medium4.9Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
Post Export Import with Media
≤1.17.2Update to 1.18.0
- High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium4.3Cross-Site Request Forgery to trigger_bulk_action()
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium6.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
WP Booking System – Booking Calendar
≤2.1.0.3Update to 2.1.0.4
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action
WP Booking System – Booking Calendar
≤2.1.0.3Update to 2.1.0.4
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
WP Booking System – Booking Calendar
≤2.1.0.3Update to 2.1.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter
EU VAT Assistant for WooCommerce
≤2.1.30.260413Update to 2.2.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
Themify Popup
≤1.4.7Update to 1.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
Themify Builder
≤7.8.2Update to 7.8.3
- Medium4.9Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
Welcart e-Commerce
≤2.12.4Update to 2.12.5
- Critical9.8Unauthenticated PHP Object Injection via 'checkout-email' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Low3.7Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- High7.2Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.2Update to 6.4.0
- Critical9.1Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- Medium6.1Reflected Cross-Site Scripting via 'token_id' Parameter
Hippoo Mobile App for WooCommerce
≤1.12.0Update to 1.12.1
- High7.2Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.2Update to 6.4.0