WordPress Plugin Vulnerabilities

ANAC XML Viewer < 1.8.3 - Authenticated (Contributor+) Server-Side Request Forgery

Description

The ANAC XML Viewer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
anac-xml-viewer
Fixed in 1.8.3

References

CVE
CVE-2025-64252
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/988bc04a-9294-4433-b4b2-d7ccf2e08297

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Nabil Irawan
Verified
No
WPVDB ID
753f0b86-4e52-4072-8867-fc9377bd5702

Timeline

Publicly Published
2025-11-26 (about 8 months ago)
Added
2026-01-15 (about 7 months ago)
Last Updated
2026-01-19 (about 7 months ago)

Other

Published
Title
Published
2026-01-27
Title
TableMaster for Elementor < 1.3.7 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter
Published
2025-04-30
Title
Gravity Forms WebHooks < 1.7.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook
Published
2025-10-23
Title
Real Cookie Banner: GDPR & ePrivacy Cookie Consent < 5.2.5 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint
Published
2025-10-23
Title
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers < 2.1.5 - Unauthenticated Server-Side Request Forgery
Published
2024-07-11
Title
Magical Addons For Elementor < 1.1.42 - Authenticated (Subscriber+) Server-Side Request Forgery