CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 77)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.9Authenticated (Administrator+) Path Traversal
BackWPup – WordPress Backup & Restore Plugin
<5.7.7Update to 5.7.7
- Medium5.3Unauthenticated Information Exposure
BackWPup – WordPress Backup & Restore Plugin
<5.7.7Update to 5.7.7
- High7.2Unauthenticated Stored Cross-Site Scripting
LMS - Education WordPress Theme
≤8.3No patch available
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
FoodBakery | Food Delivery Single & Multiple Restaurant Template
≤4.6No patch available
- High8.1Unauthenticated PHP Object Injection
FC United | Football, Soccer & Sports WordPress Theme + Events & Shop
≤1.1.1No patch available
- High8.1Authenticated (Author+) Arbitrary File Deletion
Presto Player Pro
≤3.0.1Update to 3.0.2
- Medium4.3Cross-Site Request Forgery
WPComplete
≤2.9.5.6Update to 2.9.5.7
- Medium5.3Missing Authorization
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators
≤1.2.21Update to 1.2.22
- High8.1Unauthenticated PHP Object Injection
Juno | Kids Toys & Games Store WordPress Theme
≤2.25No patch available
- High8.1Unauthenticated PHP Object Injection
Avala - Wedding & Event WordPress Theme
≤1.1.4No patch available
- High8.1Unauthenticated Local File Inclusion
Teoro - One Page WordPress Theme
≤1.1No patch available
- High8.1Unauthenticated Local File Inclusion
Volos - One Page Resume WordPress Theme
≤1.2No patch available
- High8.1Unauthenticated Local File Inclusion
Cardea - Portfolio One Page WordPress Theme
≤2.3No patch available
- Medium6.1Reflected Cross-Site Scripting
Ambed - Wallpapers & Painting Services WordPress Theme
≤1.0.0No patch available
- Medium4.3Authenticated (Subscriber+) Race Condition
Tutor LMS – eLearning and online course solution
≤4.1.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Post Snippets – Custom WordPress Code Snippets Customizer
≤4.2.4No patch available
- Medium6.5Authenticated (Author+) Path Traversal
W3 Total Cache
≤2.10.5Update to 2.10.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
HollerBox — Fast & Effective Popups & Lead-Generation
≤2.3.14Update to 2.3.15
- Medium4.32.2.0 - Authenticated (Contributor+) Insecure Direct Object Reference
Portfolio Filter Gallery – Photo Gallery
2.0.2 – 2.2.0Update to 2.2.1
- Critical9.1Unauthenticated Arbitrary File Deletion
rtMedia for WordPress, BuddyPress and bbPress
≤4.7.13Update to 4.7.14
- Medium4.3Missing Authorization
Event Tickets and Registration
≤5.30.0.1Update to 5.30.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.12Update to 3.7.12.1
- Medium4.3Missing Authorization
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets
≤4.5.5Update to 4.5.6
- Medium4.3Cross-Site Request Forgery
Database Addon For WPForms ( wpforms entries ) – WPFormsDB
<1.1.1Update to 1.1.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
<5.7.3Update to 5.7.3
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
<5.6.9Update to 5.6.9
- Medium4.3Authenticated (Subscriber+) Information Exposure
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<3.7.1Update to 3.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.52Update to 3.7.53
- Medium6.5Authenticated (Custom Role+) SQL Injection
Vitepos – Point of Sale (POS) for WooCommerce
≤3.6.1Update to 3.6.2
- Medium4.9Authenticated (Administrator+) SQL Injection
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.279Update to 1.0.280