CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 7)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
- Medium5.3Missing Authorization
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Vidplex – Ultimate Video Gallery Block for YouTube in Gutenberg
≤1.0.3Update to 1.0.4
- Medium4.3Missing Authorization
Dropshipping XML Import for WooCommerce
≤1.7.4Update to 1.7.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Customer Area
≤8.4.3Update to 8.4.4
- Medium5.3Missing Authorization
Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events
≤1.0.20Update to 1.0.21
- Medium4.3Cross-Site Request Forgery
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.90Update to 5.5.91
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤10.0.2Update to 10.0.3
- Medium4.3Missing Authorization
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.2.2Update to 2.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HTML5 Video Player – embed fast, responsive videos with ease
≤2.14.1Update to 2.14.2
- Medium4.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.3.0Update to 5.3.1
- Medium5.3Missing Authorization
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.13.0Update to 2.13.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Spectra Legacy – Gutenberg Blocks
≤2.20.4Update to 2.20.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.71Update to 3.1.72
- Medium6.1Reflected Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10.3Update to 1.10.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤5.0.0Update to 5.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.50Update to 1.15.51
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10.6Update to 8.10.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Welcart e-Commerce
≤2.12.6Update to 2.12.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Checkout Files Upload for WooCommerce
≤2.4.0Update to 2.4.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Motors – Car Dealership & Classified Listings Plugin
≤1.4.128Update to 1.4.129
- Medium6.3Authenticated (Technician+) Privilege Escalation
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1234Update to 4.1235
- High7.2Unauthenticated Stored Cross-Site Scripting
FV Flowplayer Video Player
≤7.5.56.7212Update to 7.5.57.7212
- High7.2Unauthenticated Stored Cross-Site Scripting
ACF Frontend Admin by DynamiApps
≤3.30.1Update to 3.30.2
- Medium5.3Unauthenticated Information Exposure
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Flying Images: Optimize and Lazy Load Images for Faster Page Speed
≤2.4.15Update to 2.4.16
- Medium6.1Reflected Cross-Site Scripting
WP Inventory Manager
≤2.5.9Update to 2.5.10
- Medium5.3Missing Authorization
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
≤2.6.1Update to 2.6.2
- Medium5.3Unauthenticated Information Exposure
Addon Elements for Elementor (formerly Elementor Addon Elements)
≤1.15Update to 1.15.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Events Calendar
≤6.18.3Update to 6.18.3.1
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3