CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 65)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated PHP Object Injection
Mission
≤1.22No patch available
- High8.1Unauthenticated PHP Object Injection
Le Truffe
≤1.1.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Easy Property Listings
≤3.5.25Update to 3.5.26
- Medium5.3Unauthenticated Race Condition
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.8No patch available
- High8.1Unauthenticated PHP Object Injection
Affiliates
≤7.0.1Update to 7.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.16Update to 3.8.16.1
- Medium5.3Missing Authorization
WP OAuth Server ( Login with WordPress )
≤6.4.0Update to 6.5.0
- Medium5.3Missing Authorization
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.6Update to 3.6.6.1
- Medium5.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium4.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Frontend Dashboard
≤3.0.7Update to 3.0.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP w3all phpBB
≤3.1.0Update to 3.1.2
- High7.5Authenticated (Custom Role+) PHP Object Injection
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.3Update to 4.9.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Modern Events Calendar Lite
<7.37.0Update to 7.37.0
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Disclosure
Booster Elite for WooCommerce
<8.4.0Update to 8.4.0
- Medium6.1Reflected Cross-Site Scripting
Marin
≤0.1.1Update to 0.1.2
- Critical9.1Unauthenticated Arbitrary File Deletion
File Upload to Order for WooCommerce
≤1.1.3Update to 1.1.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium5.3Unauthenticated Session Hijacking
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.2Update to 7.3.3
- Medium5.3Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.22Update to 2.3.23
- High7.2Unauthenticated Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.3Update to 4.9.4
- Medium6.5Unauthenticated Arbitrary Shortcode Injection
Mailonix – Email Template Customizer for WooCommerce
≤1.3.4Update to 1.3.5
- High7.3Unauthenticated Arbitrary Shortcode Execution
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon
≤1.3.0Update to 1.3.1
- High8.1Unauthenticated PHP Object Injection
Gunslinger
≤1.11No patch available
- High8.1Gaming Metaverse Game & Crypto WordPress Theme <= 1.19 - Unauthenticated PHP Object Injection
Gamic - Gaming Metaverse Game & Crypto WordPress Theme
≤1.19No patch available
- High8.1Unauthenticated PHP Object Injection
EmojiNation
≤1.0.12No patch available
- High8.1Unauthenticated PHP Object Injection
Coinpress
≤1.0.15No patch available
- High8.1Unauthenticated PHP Object Injection
Avventure
≤1.1.12No patch available
- High8.1Unauthenticated PHP Object Injection
Orpheus
≤1.8No patch available
- High8.1Music Festival & Concert WordPress Theme <= 1.15 - Unauthenticated PHP Object Injection
Muzicon - Music Festival & Concert WordPress Theme
≤1.15No patch available