WordPress security by component
Featured Image from URL (FIFU)
Plugin description
Featured Image from URL (FIFU) is a WordPress component with 11 published CVE records in this archive. The latest tracked vulnerability was published Jan 10, 2026; the highest CVE/CNA score is 6.4.
Plugin slug:
featured-image-from-urlLatest vulnerability
CVE-2025-13393: Featured Image from URL (FIFU): Server-side request forgery
Featured Image from URL (FIFU) is affected by server-side request forgery. Exploitation requires at least contributor-level access. The vulnerable server can be induced to make attacker-selected network requests.
| Safe version |
|
||
|---|---|---|---|
| Jan 10, 2026 |
CVE-2025-13393
Featured Image from URL (FIFU): Server-side request forgery
Featured Image from URL (FIFU) is affected by server-side request forgery. Exploitation requires at least contributor-level access. The vulnerable server can be induced to make attacker-selected network requests.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Sep 26, 2025 |
CVE-2025-9985
Featured Image from URL (FIFU): Sensitive information exposure
Featured Image from URL (FIFU) is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Sep 26, 2025 |
CVE-2025-9984
Featured Image from URL (FIFU): A security weakness
Featured Image from URL (FIFU) is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Sep 26, 2025 |
CVE-2025-10037
Featured Image from URL (FIFU): SQL injection
Featured Image from URL (FIFU) is affected by SQL injection. Exploitation requires at least administrator-level access. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE4.9
NVDPending
|
| Sep 26, 2025 |
CVE-2025-10036
Featured Image from URL (FIFU): SQL injection
Featured Image from URL (FIFU) is affected by SQL injection. Exploitation requires at least administrator-level access. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE4.9
NVDPending
|
| Nov 01, 2024 |
CVE-2024-37516
Featured Image from URL: A security weakness
Featured Image from URL is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.3
NVDPending
|
| Nov 01, 2024 |
CVE-2024-37276
Featured Image from URL: A security weakness
Featured Image from URL is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Feb 29, 2024 |
CVE-2024-1496
Featured Image from URL (FIFU): Cross-site scripting
Featured Image from URL (FIFU) is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Jan 11, 2024 |
CVE-2023-6561
Featured Image from URL (FIFU): Cross-site scripting
Featured Image from URL (FIFU) is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Aug 01, 2022 |
CVE-2022-2278
Featured Image from URL (FIFU): Cross-site scripting
Featured Image from URL (FIFU) is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVD4.8
|
| Aug 01, 2022 |
CVE-2022-2241
Featured Image from URL (FIFU): Cross-site scripting
Featured Image from URL (FIFU) is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|