CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 52)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint
DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More
≤1.5.1Update to 1.6.0
- High7.2Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute
Name Directory
≤1.34.2Update to 1.34.3
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.5Update to 4.17.6
- High7.5Unauthenticated SQL Injection via 'src_by' Parameter
Vitepos – Point of Sale (POS) for WooCommerce
≤3.5.1Update to 3.6.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
Tutor LMS – eLearning and online course solution
≤4.1.0Update to 4.1.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting
Social Share Buttons
≤1.30Update to 1.31
- High7.2Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header
User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin
≤6.2.9Update to 6.3.0
- High8.1Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials
Vulnity Security
≤1.4.3Update to 1.4.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter
FiboSearch – Ajax Search for WooCommerce
≤1.34.2Update to 1.34.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
SureDash – Community, Courses & Member Dashboard
≤1.12.0Update to 1.12.1
- Critical9.8Unauthenticated PHP Object Injection via 'key' Parameter
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.7.4Update to 3.7.5
- Medium5.3Missing Authorization
PlanetStudio Payment Gateway
≤1.3.3Update to 1.3.4
- Medium4.3Authenticated (Contributor+) Information Exposure
Infinite Uploads – Offload, Optimize & Organize Your Media Library
≤3.4.1Update to 3.4.2
- Medium4.3Missing Authorization
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤4.0.1Update to 4.0.2
- Medium4.3Missing Authorization
OTP Login With Phone Number, OTP Verification
≤1.8.77Update to 1.8.78
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Presto Player
≤4.5.3Update to 4.5.4
- Medium5.3Missing Authorization
Knowledge Base
≤3.2.0Update to 3.2.1
- Medium5.3Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.23Update to 2.3.24
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Download Monitor
≤5.3.3Update to 5.3.4
- Medium5.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.7.4Update to 3.7.5
- Medium5.3Missing Authorization
Ajax Search Lite – Live Search & Filter
≤4.14.5Update to 4.14.6
- Medium4.3Missing Authorization
Strong Testimonials
≤3.3.12Update to 3.3.13
- Medium5.3Missing Authorization
Ninja Forms Signature Contract Add-On
≤3.2.5Update to 3.2.5.1
- Medium5.3Missing Authorization
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.4Update to 4.5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
YITH WooCommerce Compare
≤3.15.0Update to 3.15.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic)
≤1.5.3Update to 1.5.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.192Update to 2.8.193
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.7Update to 3.3.8
- High7.2Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter
CP Multi View Events Calendar
≤1.4.42Update to 1.4.43