Plugin icon

Featured Image from URL (FIFU)

featured-image-from-url

Vulnerabilities:

13

Last Updated:

February 2, 2026

Active Installs:

70000

Published
Title
Fixed in
CVSS
Published
2026-01-09
Title
Featured Image from URL (FIFU) < 5.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url'
Fixed in
Fixed in 5.3.2
CVSS
4.3 (medium)
Published
2025-10-06
Title
Featured Image from URL (FIFU) < 5.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields
Fixed in
Fixed in 5.2.8
CVSS
6.4 (medium)
Published
2025-09-25
Title
Featured Image from URL (FIFU) < 5.2.8 - Missing Authorization to Password Protected Post Disclosure
Fixed in
Fixed in 5.2.8
CVSS
5.3 (medium)
Published
2025-09-25
Title
Featured Image from URL (FIFU) < 5.2.8 - Unauthenticated Information Exposure via Log File
Fixed in
Fixed in 5.2.8
CVSS
5.3 (medium)
Published
2025-09-25
Title
Featured Image from URL (FIFU) < 5.2.8 - Authenticated (Admin+) SQL Injection
Fixed in
Fixed in 5.2.8
CVSS
4.9 (medium)
Published
2025-09-25
Title
Featured Image from URL (FIFU) < 5.2.8 - Authenticated (Admin+) SQL Injection
Fixed in
Fixed in 5.2.8
CVSS
4.9 (medium)
Published
2024-07-05
Title
Featured Image from URL < 4.8.3 - Missing Authorization
Fixed in
Fixed in 4.8.3
CVSS
4.3 (medium)
Published
2024-06-28
Title
Featured Image from URL < 4.8.2 - Missing Authorization
Fixed in
Fixed in 4.8.2
CVSS
5.3 (medium)
Published
2024-02-19
Title
Featured Image from URL (FIFU) < 4.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url
Fixed in
Fixed in 4.6.3
CVSS
6.4 (medium)
Published
2023-12-14
Title
Featured Image from URL (FIFU) < 4.5.4 - Contributor+ Stored XSS
Fixed in
Fixed in 4.5.4
CVSS
5.9 (medium)
Published
2022-07-11
Title
Featured Image from URL < 4.0.1 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 4.0.1
CVSS
3.4 (low)
Published
2022-07-11
Title
Featured Image from URL < 4.0.0 - Arbitrary Settings Update to Stored XSS via CSRF
Fixed in
Fixed in 4.0.0
CVSS
6.1 (medium)
Published
2019-12-24
Title
Featured Image from URL <= 2.7.7 - Missing Access Controls on REST routes
Fixed in
Fixed in 2.7.8
CVSS
n/a