WordPress Plugin Vulnerabilities

Jrss Widget <= 1.2 - SSRF

Description

Plugin is still affected and has been closed.

Affects Plugins

Plugin icon
jrss-widget
No known fix

References

CVE
CVE-2014-9292
URL
https://codevigilant.com/disclosure/wp-plugin-jrss-widget-ssrfxspa/

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918

Miscellaneous

Verified
No
WPVDB ID
cd853a2e-1c90-4e5c-8f9c-18d01d611764

Timeline

Publicly Published
2014-05-28 (about 11 years ago)
Added
2019-08-23 (about 6 years ago)
Last Updated
2019-11-28 (about 6 years ago)

Other

Published
Title
Published
2025-12-31
Title
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Server-Side Request Forgery
Published
2026-04-10
Title
UsersWP < 1.2.59 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter
Published
2023-12-11
Title
affiliate-toolkit < 3.4.3 - Unauthenticated SSRF
Published
2025-03-25
Title
Product Import Export for WooCommerce < 2.5.1 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
Published
2024-05-30
Title
Blocksy Companion < 2.0.43 - Authenticated (Admin+) Server-Side Request Forgery