CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 74)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.3Update to 1.58.0
- Medium6.1Reflected Cross-Site Scripting
WPAdverts – Classifieds Plugin
≤2.3.4Update to 2.3.5
- High7.2Unauthenticated Stored Cross-Site Scripting
WPAdverts – Classifieds Plugin
≤2.3.4Update to 2.3.5
- High8.1Unauthenticated PHP Object Injection
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤8.4.0Update to 8.5.0
- High7.5Authenticated (Custom Role+) PHP Object Injection
Tainacan
≤1.3.0Update to 1.4.0
- High7.5Authenticated (Contributor+) PHP Object Injection
Slider by 10Web – Responsive Image Slider
≤1.2.62Update to 1.2.63
- High7.2Unauthenticated Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.3Update to 1.58.0
- Medium5.3Missing Authorization
Sell Downloads
≤1.2.3Update to 1.2.4
- High8.1Blog Magazine Theme <= 2.2.1 - Unauthenticated PHP Object Injection
Kicker - Blog Magazine Theme
≤2.2.1No patch available
- High8.1Unauthenticated PHP Object Injection
jacqueline
≤2.22No patch available
- High8.1Unauthenticated PHP Object Injection
Alliance | Intranet & Extranet BuddyPress WordPress Theme
≤3.11No patch available
- High8.1Blog \ Resume \ Portfolio \ WordPress Theme <= 3.0.14 - Unauthenticated PHP Object Injection
ShiftCV - Blog \ Resume \ Portfolio \ WordPress Theme
≤3.0.14No patch available
- High8.1Apartment Complex Single Property WordPress Theme <= 2.10 - Unauthenticated PHP Object Injection
Windsor - Apartment Complex Single Property WordPress Theme
≤2.10No patch available
- High8.1Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT <= 3.6.1 - Unauthenticated PHP Object Injection
Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT
≤3.6.1No patch available
- High8.1Intranet, Extranet, Community and BuddyPress WordPress Theme <= 1.5.3 - Unauthenticated PHP Object Injection
Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme
≤1.5.3No patch available
- High8.1Publishing House, Bookshop & BookStore WordPress Theme + RTL <= 2.13.0 - Unauthenticated PHP Object Injection
Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL
≤2.13.0No patch available
- High8.1Unauthenticated PHP Object Injection
Drone Media | Aerial Photography & Videography Theme
≤2.2.0No patch available
- High8.1Unauthenticated PHP Object Injection
Gutentype | 100% Gutenberg Blog Theme + Elementor
≤2.1.12No patch available
- High8.1Unauthenticated PHP Object Injection
Camelia | Floral Studio Florist WordPress Theme
≤1.2.15No patch available
- High8.1Architecture & Interior Design WordPress Theme <= 1.16.0 - Unauthenticated PHP Object Injection
Convex - Architecture & Interior Design WordPress Theme
≤1.16.0No patch available
- High8.1Building, Construction & Renovation Theme <= 1.16.0 - Unauthenticated PHP Object Injection
Dwell - Building, Construction & Renovation Theme
≤1.16.0No patch available
- High8.1Unauthenticated PHP Object Injection
Edema | Wellness & Spa WordPress Theme
≤1.2.2.2No patch available
- High8.1Electric Car Dealership WordPress Theme <= 2.10.0 - Unauthenticated PHP Object Injection
Greeny - Electric Car Dealership WordPress Theme
≤2.10.0No patch available
- High8.1Unauthenticated PHP Object Injection
Hogwords | School, University Education WordPress Theme
≤1.2.7No patch available
- High8.1Cleaning Services WordPress Theme <= 1.21.0 - Unauthenticated PHP Object Injection
Hygia - Cleaning Services WordPress Theme
≤1.21.0No patch available
- High8.1Online Pharmacy Woocommerce Elementor Template Kit <= 1.2.4 - Unauthenticated PHP Object Injection
iPharm - Online Pharmacy Woocommerce Elementor Template Kit
≤1.2.4No patch available
- High8.1Unauthenticated PHP Object Injection
Let's Play | Hockey School & Winter Sports WordPress Theme
≤1.1.15No patch available
- High8.1Unauthenticated PHP Object Injection
Partiso | Political Party & Candidate Elementor Template Kit
≤1.1.13No patch available
- High8.1Unauthenticated PHP Object Injection
Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme
≤1.2.4No patch available
- High8.1Unauthenticated PHP Object Injection
Smart Casa | Home Automation & House Technologies WordPress Theme
≤1.0.12No patch available