Server-side request forgery (SSRF) in WordPress plugins

Server-side request forgery makes your server fetch a URL the attacker picks. Plugins that import images, preview links or call webhooks are the usual places this shows up.

The risk is that your server can reach things the attacker cannot: services on localhost, the hosting provider’s internal network, or cloud metadata endpoints that hand out access keys. On simple shared hosting the impact is often small; on cloud servers it can be serious.

What to do: update the plugin. If you host on a cloud server, make sure the metadata service requires a token (IMDSv2 on AWS) so a forged request cannot read credentials.

Worried a plugin bug was used on your site?

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Newest Server-side request forgery (SSRF) records

269 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

medium 5.8 Customer Engagement System

Server-side request forgery (SSRF)

CVE-2026-115225 · affected older than 2.0.2 · fixed in 2.0.2 · published 2026-10-28
high 7.3 PhastPress

Server-side request forgery (SSRF)

CVE-2026-3712 · affected 3.10 and older · fixed in 3.11 * · published 2026-10-15
medium 4.1 FV Flowplayer Video Player

Server-side request forgery (SSRF)

CVE-2026-85345 · affected 7.5.44.7212 up to (not including) 7.5.55.7212 · fixed in 7.5.55.7212 · published 2026-10-14
high 7.2 StreamCast

Server-side request forgery (SSRF)

CVE-2026-62030 · affected 2.4.5 and older · fixed in 2.4.6 * · published 2026-10-10
high 7.2 Builderius

Server-side request forgery (SSRF)

CVE-2026-27350 · affected 1.4 to 1.4-beta · fix not stated · published 2026-10-10
medium 4.1 Kirki

Server-side request forgery (SSRF)

CVE-2026-84224 · affected older than 6.3.2 · fixed in 6.3.2 · published 2026-10-09
medium 4.1 PowerPress Podcasting plugin by Blubrry

Server-side request forgery (SSRF)

CVE-2026-97354 · affected 11.13.12 up to (not including) 11.17.11 · fixed in 11.17.11 · published 2026-10-07
high 7.2 Instapage Plugin

Server-side request forgery (SSRF)

CVE-2026-39728 · affected 3.7.2 and older · fixed in 3.7.3 * · published 2026-10-06
high 7.2 affects latest 1.0.4 PDF Smart Viewer for Elementor

Server-side request forgery (SSRF)

CVE-2026-39719 · affected 1.0.4 and older · no fix listed yet · published 2026-10-06
high 7.2 LA-Studio Element Kit for Elementor

Server-side request forgery (SSRF)

CVE-2026-103082 · affected 1.6.2 and older · fixed in 1.6.3 · published 2026-10-01
medium 5.8 Broken Link Notifier

Server-side request forgery (SSRF)

CVE-2026-97316 · affected 1.3.1 up to (not including) 2.0.0.1 · fixed in 2.0.0.1 · published 2026-09-30
medium 4.1 WPeMatico RSS Feed Fetcher

Server-side request forgery (SSRF)

CVE-2026-89003 · affected older than 2.8.27 · fixed in 2.8.27 · published 2026-09-27
medium 4.1 WPeMatico RSS Feed Fetcher

Server-side request forgery (SSRF)

CVE-2026-89000 · affected older than 2.8.27 · fixed in 2.8.27 · published 2026-09-27
medium 5.5 Asset CleanUp

Server-side request forgery (SSRF)

CVE-2026-12037 · affected 1.4.0.5 and older · fixed in 1.4.0.6 * · published 2026-09-25
medium 4.0 Link Library

Server-side request forgery (SSRF)

CVE-2026-78397 · affected 7.8.8 up to (not including) 7.9.6 · fixed in 7.9.6 · published 2026-09-25
medium 5.4 Kirki

Server-side request forgery (SSRF)

CVE-2026-18335 · affected 6.2.0 and older · fixed in 6.2.1 * · published 2026-09-24
medium 5.0 Directorist

Server-side request forgery (SSRF)

CVE-2026-84046 · affected older than 8.9.5 · fixed in 8.9.5 · published 2026-09-23
medium 4.1 Import and export users and customers

Server-side request forgery (SSRF)

CVE-2026-16542 · affected older than 2.4.5 · fixed in 2.4.5 · published 2026-09-20
medium 6.5 Wow Elements Addons for Elementor

Server-side request forgery (SSRF)

CVE-2026-1641 · affected 1.11.2 and older · fixed in 1.11.3 * · published 2026-09-19
medium 6.4 Auto Upload Images

Server-side request forgery (SSRF)

CVE-2026-12106 · affected 3.3.2 and older · fixed in 3.4.0 * · published 2026-09-18
medium 5.8 Generate PDF using Contact Form 7

Server-side request forgery (SSRF)

CVE-2026-90984 · affected older than 4.2.2 · fixed in 4.2.2 · published 2026-09-18
medium 6.4 Unlimited Elements for Elementor

Server-side request forgery (SSRF)

CVE-2026-66608 · affected 2.0.19 and older · fixed in 2.0.20 · published 2026-09-17
medium 4.1 WP Import Export Lite

Server-side request forgery (SSRF)

CVE-2026-76559 · affected older than 3.9.33 · fixed in 3.9.33 · published 2026-09-16
high 7.2 Hide My WP Ghost

Server-side request forgery (SSRF)

CVE-2026-81806 · affected 7.0.09 and older · fixed in 7.0.10 · published 2026-09-08
medium 5.4 SEOPress

Server-side request forgery (SSRF)

CVE-2026-85305 · affected 10.1 and older · fixed in 10.2 · published 2026-09-03
high 7.2 LiteSpeed Cache

Server-side request forgery (SSRF)

CVE-2026-84761 · affected 7.9 and older · fixed in 7.9.1 · published 2026-09-03
medium 5.5 Broken Link Checker

Server-side request forgery (SSRF)

CVE-2026-84772 · affected 2.4.14 and older · fixed in 2.4.14.1 · published 2026-09-02
medium 5.4 MapSVG

Server-side request forgery (SSRF)

CVE-2026-82852 · affected 8.15.0 and older · fixed in 8.16.0 * · published 2026-08-31
medium 5.3 Everest Forms

Server-side request forgery (SSRF)

CVE-2026-5096 · affected 3.4.4 and older · fixed in 3.4.5 * · published 2026-08-28
medium 6.4 Shared Files

Server-side request forgery (SSRF)

CVE-2026-78269 · affected 1.7.69 and older · fixed in 1.7.70 · published 2026-08-24
high 7.2 OttoKit

Server-side request forgery (SSRF)

CVE-2026-32553 · affected 1.1.35 and older · fixed in 1.1.36 · published 2026-08-18
high 7.2 affects latest 1.0.4 PDF Smart Viewer for Elementor

Server-side request forgery (SSRF)

CVE-2026-32473 · affected 1.0.4 and older · no fix listed yet · published 2026-08-18
medium 6.0 affects latest 2.0.1 [凹凸曼] 一键采集微信文章

Server-side request forgery (SSRF)

CVE-2026-32467 · affected 2.0.1 and older · no fix listed yet · published 2026-08-18
high 8.8 Royal Addons for Elementor

Server-side request forgery (SSRF)

CVE-2026-17123 · affected 1.7.1064 and older · fixed in 1.7.1065 * · published 2026-08-16
high 7.2 Gutenverse Companion

Server-side request forgery (SSRF)

CVE-2026-66704 · affected 2.5.1 and older · fixed in 2.5.2 · published 2026-08-13
high 7.1 PowerPress Podcasting plugin by Blubrry

Server-side request forgery (SSRF)

CVE-2026-16294 · affected older than 11.17.1 · fixed in 11.17.1 · published 2026-08-12
medium 5.0 All-in-One Video Gallery

Server-side request forgery (SSRF)

CVE-2026-19075 · affected older than 4.9.2 · fixed in 4.9.2 · published 2026-08-10
low 2.2 LearnPress

Server-side request forgery (SSRF)

CVE-2026-12971 · affected older than 4.4.4 · fixed in 4.4.4 · published 2026-08-10
high 8.2 Newsletters

Server-side request forgery (SSRF)

CVE-2026-16268 · affected older than 4.16 · fixed in 4.16 · published 2026-08-06
medium 5.8 EmbedPress

Server-side request forgery (SSRF)

CVE-2026-10526 · affected older than 4.6.1 · fixed in 4.6.1 · published 2026-08-04
medium 4.9 WP CTA

Server-side request forgery (SSRF)

CVE-2026-6089 · affected 2.1.2 only · fixed in 2.1.3 * · published 2026-07-29
medium 4.1 Media Cleaner

Server-side request forgery (SSRF)

CVE-2026-4912 · affected 7.0.3 and older · fixed in 7.0.4 * · published 2026-07-28
medium 4.9 RSS Aggregator by Feedzy

Server-side request forgery (SSRF)

CVE-2026-66437 · affected 5.2.4 and older · fixed in 5.2.5 · published 2026-07-27
medium 5.4 AffiliateX

Server-side request forgery (SSRF)

CVE-2026-65558 · affected 2.3.5 and older · fixed in 2.3.6 · published 2026-07-27
high 7.2 Flipbook PDF Viewer & Embedder

Server-side request forgery (SSRF)

CVE-2026-59552 · affected 1.4.2 and older · fixed in 1.4.4 · published 2026-07-27
high 7.2 affects latest 2.2.6 PeproDev Ultimate Invoice

Server-side request forgery (SSRF)

CVE-2026-65516 · affected 2.2.6 and older · no fix listed yet · published 2026-07-23
medium 4.4 Complianz GDPR/CCPA Cookie Consent Banner

Server-side request forgery (SSRF)

CVE-2026-65496 · affected 7.5.0 and older · fixed in 7.5.1 * · published 2026-07-23
medium 4.4 Photo Block

Server-side request forgery (SSRF)

CVE-2026-24639 · affected 1.7.1 and older · fix not stated · published 2026-07-23
critical 9.1 Kirki

Server-side request forgery (SSRF)

CVE-2026-13147 · affected older than 6.0.12 · fixed in 6.0.12 · published 2026-07-20
medium 4.9 Auto Featured Image (Auto Post Thumbnail)

Server-side request forgery (SSRF)

CVE-2026-61970 · affected 5.0.4 and older · fixed in 5.0.5 · published 2026-07-13
medium 6.4 Instant AI Image Generator

Server-side request forgery (SSRF)

CVE-2026-57413 · affected 2.1.4 and older · fixed in 2.1.5 · published 2026-07-13
high 7.2 PDF Generator for WordPress

Server-side request forgery (SSRF)

CVE-2026-57407 · affected 1.6.2 and older · fixed in 1.6.3 · published 2026-07-13
high 7.2 WPJAM Basic

Server-side request forgery (SSRF)

CVE-2026-57372 · affected 7.0 and older · fixed in 7.0.1 · published 2026-07-13
medium 6.4 All-in-One Video Gallery

Server-side request forgery (SSRF)

CVE-2026-12123 · affected 4.8.5 and older · fixed in 4.9.0 * · published 2026-07-10
medium 5.5 WP Import Export Lite

Server-side request forgery (SSRF)

CVE-2026-11397 · affected 3.9.30 and older · fixed in 3.9.31 * · published 2026-07-03
medium 6.4 GeoDirectory

Server-side request forgery (SSRF)

CVE-2026-57681 · affected 2.8.161 and older · fixed in 2.8.162 · published 2026-07-02
high 7.2 Paid Membership Subscriptions

Server-side request forgery (SSRF)

CVE-2026-57348 · affected 3.0.4 and older · fixed in 3.0.5 · published 2026-07-02
medium 4.9 Kirki

Server-side request forgery (SSRF)

CVE-2026-57627 · affected 6.0.11 and older · fixed in 6.0.12 · published 2026-06-26
medium 6.4 utm.codes

Server-side request forgery (SSRF)

CVE-2026-56026 · affected 1.9.0 and older · fixed in 1.9.1 · published 2026-06-26
high 7.2 Kargo Takip

Server-side request forgery (SSRF)

CVE-2026-12095 · affected 1.2 and older · fix not stated · published 2026-06-24
high 7.2 URL Preview

Server-side request forgery (SSRF)

CVE-2026-12100 · affected 1.0 and older · fix not stated · published 2026-06-24
medium 6.4 WP Meta SEO

Server-side request forgery (SSRF)

CVE-2026-11370 · affected 4.5.18 and older · fix not stated · published 2026-06-24
medium 6.5 Bit integrations

Server-side request forgery (SSRF)

CVE-2026-11989 · affected 2.8.7 and older · fixed in 2.8.8 * · published 2026-06-19
high 7.2 CF7 to Webhook

Server-side request forgery (SSRF)

CVE-2026-11395 · affected 5.0.0 and older · fixed in 5.0.1 * · published 2026-06-18
medium 4.4 PopAd

Server-side request forgery (SSRF)

CVE-2025-60175 · affected 1.0.4 and older · fix not stated · published 2026-06-15
high 7.2 Gutenberg Essential Blocks

Server-side request forgery (SSRF)

CVE-2026-10586 · affected 6.1.3 and older · fixed in 6.1.4 * · published 2026-06-05
medium 6.5 Independent Analytics

Server-side request forgery (SSRF)

CVE-2026-5737 · affected 2.14.9 and older · fixed in 2.14.10 * · published 2026-05-28
medium 5.4 FluentCRM

Server-side request forgery (SSRF)

CVE-2026-7798 · affected 2.9.87 and older · fixed in 3.0.0 * · published 2026-05-22
medium 5.4 Nexa Blocks

Server-side request forgery (SSRF)

CVE-2026-6394 · affected 1.1.1 and older · fix not stated · published 2026-05-20
medium 6.4 Gutenverse

Server-side request forgery (SSRF)

CVE-2026-2948 · affected 3.5.3 and older · fixed in 3.6.0 * · published 2026-05-05
high 7.2 Royal Addons for Elementor

Server-side request forgery (SSRF)

CVE-2026-6229 · affected 1.7.1057 and older · fixed in 1.7.1058 * · published 2026-05-02
medium 5.4 Share This Image

Server-side request forgery (SSRF)

CVE-2026-42641 · affected 2.14 and older · fixed in 2.15 · published 2026-04-29
medium 5.0 UsersWP

Server-side request forgery (SSRF)

CVE-2026-4979 · affected 1.2.58 and older · fixed in 1.2.59 * · published 2026-04-11
medium 5.4 Podigee for WordPress

Server-side request forgery (SSRF)

CVE-2026-39695 · affected 1.4.0 and older · fixed in 1.4.1 * · published 2026-04-08
medium 6.0 Visual Link Preview

Server-side request forgery (SSRF)

CVE-2026-39670 · affected 2.3.0 and older · fixed in 2.3.1 * · published 2026-04-08
medium 5.4 GlobalPayments Gateway Provider for WooCommerce

Server-side request forgery (SSRF)

CVE-2026-39645 · affected 1.18.0 and older · fixed in 1.18.1 * · published 2026-04-08
medium 5.4 MP3 Audio Player

Server-side request forgery (SSRF)

CVE-2026-39647 · affected 5.11 and older · fixed in 5.12 * · published 2026-04-08
medium 6.4 affects latest 4.1.0 Getty Images

Server-side request forgery (SSRF)

CVE-2026-39630 · affected 4.1.0 and older · no fix listed yet · published 2026-04-08
medium 4.9 Nelio Content

Server-side request forgery (SSRF)

CVE-2026-39521 · affected 4.3.1 and older · fixed in 4.3.2 · published 2026-04-08
medium 5.5 Website Builder by SeedProd

Server-side request forgery (SSRF)

CVE-2026-39464 · affected 6.19.8 and older · fixed in 6.19.9 · published 2026-04-08
medium 6.4 Webmention

Server-side request forgery (SSRF)

CVE-2026-0688 · affected 5.6.2 and older · fixed in 5.7.0 * · published 2026-04-02
high 7.2 Webmention

Server-side request forgery (SSRF)

CVE-2026-0686 · affected 5.6.2 and older · fixed in 5.7.0 * · published 2026-04-02
medium 5.8 Performance Monitor

Server-side request forgery (SSRF)

CVE-2026-3881 · affected 1.0.6 and older · fix not stated · published 2026-03-31
medium 6.4 Contest Gallery

Server-side request forgery (SSRF)

CVE-2026-24964 · affected 28.1.2.1 and older · fixed in 28.1.2.2 · published 2026-03-25
high 7.2 Content Syndication Toolkit

Server-side request forgery (SSRF)

CVE-2026-3478 · affected 1.3 and older · fix not stated · published 2026-03-21
low 3.8 Post Affiliate Pro

Server-side request forgery (SSRF)

CVE-2026-2290 · affected 1.28.0 and older · fixed in 1.28.1 * · published 2026-03-21
high 8.3 MimeTypes Link Icons

Server-side request forgery (SSRF)

CVE-2026-1313 · affected 3.2.20 and older · fixed in 3.3.0 * · published 2026-03-21
high 7.2 WowOptin

Server-side request forgery (SSRF)

CVE-2026-4302 · affected 1.4.29 and older · fix not stated · published 2026-03-21
medium 5.4 Gift Up Gift Cards for WordPress and WooCommerce

Server-side request forgery (SSRF)

CVE-2026-32412 · affected 3.1.7 and older · fixed in 3.1.8 · published 2026-03-13
medium 6.4 Simple Blog Card

Server-side request forgery (SSRF)

CVE-2026-32357 · affected 2.37 and older · fixed in 2.38 · published 2026-03-13
medium 6.4 MailerPress

Server-side request forgery (SSRF)

CVE-2026-32353 · affected 1.4.2 and older · fixed in 1.5.0 · published 2026-03-13
medium 4.9 Embed PDF Viewer

Server-side request forgery (SSRF)

CVE-2026-32349 · affected 2.4.7 and older · fixed in 2.4.8 · published 2026-03-13
high 7.2 Post Grid Blocks & Templates for News, Magazin…

Server-side request forgery (SSRF)

CVE-2026-1273 · affected 5.0.8 and older · fix not stated · published 2026-03-04
medium 5.0 Responsive Lightbox & Gallery

Server-side request forgery (SSRF)

CVE-2026-2479 · affected 2.7.1 and older · fixed in 2.7.2 * · published 2026-02-25
medium 4.4 TS Poll

Server-side request forgery (SSRF)

CVE-2026-25428 · affected 2.5.5 and older · fixed in 2.6.0 * · published 2026-02-19
medium 5.5 URL Shortify

Server-side request forgery (SSRF)

CVE-2026-25385 · affected 1.12.3 and older · fixed in 1.12.4 · published 2026-02-19
medium 4.9 Extend Link

Server-side request forgery (SSRF)

CVE-2026-25310 · affected 2.0.0 and older · fixed in 2.0.1 · published 2026-02-19
medium 6.4 Smart Auto Upload Images

Server-side request forgery (SSRF)

CVE-2026-23803 · affected 1.2.2 and older · fixed in 1.2.3 · published 2026-02-19
medium 6.4 Printful Integration for WooCommerce

Server-side request forgery (SSRF)

CVE-2025-12375 · affected 2.2.11 and older · fixed in 2.2.12 * · published 2026-02-19
medium 4.3 Kadence Blocks

Server-side request forgery (SSRF)

CVE-2026-1857 · affected 3.6.1 and older · fixed in 3.6.2 * · published 2026-02-18

Other types

Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution · Arbitrary file upload · Path traversal and file read · Authentication bypass · File inclusion · Arbitrary file deletion · Open redirect · Denial of service · Content injection

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan