CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 63)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Document Gallery
≤5.1.1Update to 5.1.2
- Medium6.45.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Document Gallery
4.0 – 5.1.1Update to 5.1.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
MLS On The Fly
≤1.8.1.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Weaver Xtreme Theme Support
≤7.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
FV Simpler SEO
≤1.9.7Update to 1.9.8
- Medium4.3Missing Authorization
Download Monitor integration for WooCommerce
≤1.0.3Update to 1.0.4
- Medium5.3Unauthenticated Information Exposure
WPGraphQL
≤2.26.0Update to 2.26.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.7.1Update to 4.7.2
- Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
≤2.4.10Update to 2.4.11
- Medium5.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.23Update to 2.9.24
- Medium5.3Missing Authorization
Pay for Payment for WooCommerce – Payment Gateway Fees & Discounts
≤3.0.1Update to 3.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.0Update to 3.1.1
- Medium5.3Missing Authorization
FOX – Currency Switcher Professional for WooCommerce
≤1.5.4Update to 1.5.5
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
Visual Form Builder
≤3.1No patch available
- Medium6.1Reflected Cross-Site Scripting
XStore
<9.7.9Update to 9.7.9
- Medium5.33.4.1 - Unauthenticated Arbitrary Order Status Manipulation
Cardinity Payment Gateway for WooCommerce
3.2.6 – 3.4.1Update to 3.4.2
- Medium4.3Cross-Site Request Forgery
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
≤2.10.6Update to 2.10.7
- Medium4.9Authenticated (Editor+) SQL Injection via 'counterid' Parameter
Animated Number Counters
≤3.0Update to 3.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.1.0Update to 11.1.1
- Medium4.3Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium4.3Missing Authorization
WP-Members Membership Plugin
≤3.5.7Update to 3.5.8
- Medium5.3Missing Authorization
Skydropx
≤2.1.4Update to 2.1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.6.27Update to 4.6.28
- Medium6.1Reflected Cross-Site Scripting
Hippoo Mobile App for WooCommerce
≤1.12.0Update to 1.12.1
- Medium6.1Reflected Cross-Site Scripting
SimplyRETS Real Estate IDX
≤3.2.9Update to 3.3.0
- Critical9.8Unauthenticated Remote Code Execution
MDTF – Meta Data and Taxonomies Filter
≤1.3.9Update to 1.4.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.9.17Update to 1.10.0