CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 58)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Unauthenticated Arbitrary Order Status Manipulation
Paymentfor Gateway for WooCommerce
<1.0.6Update to 1.0.6
- Medium5.3Missing Authorization
SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster
<2.8.0Update to 2.8.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.9.0Update to 1.10.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Donation Thermometer
<2.3.0Update to 2.3.0
- Medium6.5Authenticated (Contributor+) SQL Injection
BSK PDF Manager
<3.8.2Update to 3.8.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
Tainacan
<1.4.0Update to 1.4.0
- High7.55.2.3 - Unauthenticated SQL Injection
Fast Courier – Shipping & Freight
5.0.0 – 5.2.3Update to 5.2.4
- Medium5.3Missing Authorization
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
<5.3.2Update to 5.3.2
- Medium5.3Missing Authorization
Trust Payments Gateway for WooCommerce
<3.1.0Update to 3.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Forms
<3.0.2Update to 3.0.2
- Medium6.47.5.55.7211 - Authenticated (Contributor+) Server-Side Request Forgery
FV Flowplayer Video Player
7.5.44.7212 – 7.5.55.7211Update to 7.5.55.7212
- Medium5.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
<3.7.4Update to 3.7.4
- Medium4.9Authenticated (Editor+) SQL Injection
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.8.8Update to 3.8.9
- Low2.7Missing Authorization
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤4.3.3Update to 4.3.4
- Medium4.3Cross-Site Request Forgery
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium5.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium6.5Authenticated (Contributor+) SQL Injection
CP Multi View Events Calendar
≤1.4.41Update to 1.4.42
- Low2.7Authenticated (Administrator+) Insecure Direct Object Reference
WP 2FA – Two-factor authentication for WordPress
<4.2.0Update to 4.2.0
- Medium5.3Missing Authorization
WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect
<7.8.8.2Update to 7.8.8.2
- Medium5.3Unauthenticated Payment Bypass
Visma Pay for Woocommerce
<1.2.2Update to 1.2.2
- High8.1Unauthenticated Local File Inclusion
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform
<2.17.2Update to 2.17.2
- Medium5.38.0.5 - Missing Authorization
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
7.9.5 – 8.0.5Update to 8.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Booking System – Booking Calendar
<2.1.0.1Update to 2.1.0.1
- Medium4.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
<6.1.1Update to 6.1.1
- Medium5.39.3.0 - Unauthenticated Insecure Direct Object Reference
NEX-Forms – Ultimate Forms Plugin for WordPress
9.2.1 – 9.3.0Update to 9.3.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
CodeAtoZ B2B Suite for WooCommerce
<1.6.1Update to 1.6.1
- Medium6.44.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
4.10.1 – 4.10.5Update to 4.10.6
- Medium5.3Missing Authorization to Unauthenticated SEO Data Deletion
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.280Update to 1.0.280
- High7.5Unauthenticated Arbitrary File Read
Contact Form 7 Signature Addon
≤4.2.2No patch available
- Medium6.5Authenticated (Contributor+) SQL Injection
Ukr-To-Lat
≤1.3.5No patch available