CWE-918Vulnerability type
WordPress SSRF vulnerabilities (page 93)
Features that fetch URLs on the server (previews, imports, webhooks) and can be pointed at internal services.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- High7.5Authenticated (Contributor+) PHP Object Injection
Unlimited Elements for Elementor
≤2.0.19Update to 2.0.20
- Medium6.1Reflected Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- High7.2Unauthenticated Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.19Update to 2.0.20
- High7.2Unauthenticated Stored Cross-Site Scripting
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.6Update to 3.3.7
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2Update to 1.57.3
- Medium5.3Unauthenticated Payment Bypass
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2Update to 1.57.2.1
- Medium6.1Reflected Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.14Update to 14.16.15
- High7.2Unauthenticated Stored Cross-Site Scripting
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.11.1Update to 3.7.12
- High8.1Unauthenticated PHP Object Injection
The Events Calendar
≤6.17.4Update to 6.17.4.1
- Medium5.3Missing Authorization
User Private Files – Secure File Sharing and Client Portal Plugin
≤2.1.0Update to 2.2.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Razorpay for WooCommerce
≤4.8.7Update to 4.8.8
- Medium5.3Unauthenticated Payment Bypass
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.8.1Update to 4.16.9
- High7.5Unauthenticated SQL Injection
WPLMS Plugin
<1.9.9.8.2Update to 1.9.9.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX
GD Rating System
≤3.7.1Update to 3.7.2
- High7.3Missing Authorization to Unauthorized Redirects
Aculect AI Companion
≤0.8.2Update to 0.8.3
- Medium4.32.3.21 - Authenticated (Author+) Information Exposure
Five Star Business Profile and Schema
2.3.20 – 2.3.21Update to 2.4.0
- Medium5.31.7.5 - Unauthenticated Insecure Direct Object Reference
File Uploads Addon for WooCommerce
1.7.2 – 1.7.5Update to 1.7.6
- Medium4.3Missing Authorization
IATO MCP
≤1.12.0Update to 1.12.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤5.0.2.0Update to 5.0.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ThemeREX Addons
≤2.46.0Update to 2.47.0
- High8.84.9.6 - Cross-Site Request Forgery to Privilege Escalation
CoCart – Headless REST API for WooCommerce
4.9.0 – 4.9.6Update to 4.9.7
- Medium5.3Unauthenticated Insecure Direct Object Reference
UPI QR Code Payment Gateway
<1.4.4Update to 1.4.4
- Medium5.3Unauthenticated Duplicate Slot Booking
Booking Calendar
≤11.8.4Update to 11.9
- Medium5.3Missing Authorization
File Uploads Addon for WooCommerce
≤1.7.6Update to 1.7.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple Shopping Cart
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
ThemeREX Addons
≤2.46.0Update to 2.47.0
- Critical9.8Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter
WPMobile.App – Android and iOS App Builder
≤11.82Update to 11.85
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
W3 Total Cache
≤2.10.6Update to 2.10.7
- Medium6.1Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.14Update to 14.16.15