CVE-2026-73340

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

EUVD-2026-57909

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

CVE-2026-73340

The CVE covers a Cross Site Scripting (XSS) vulnerability in the WordPress plugin Featured Image from URL , affecting versions

CVE-2026-73340 WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

CVE-2026-73340 WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

PT-2026-71599

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Featured Image from URL versions = 5.3.3...

CVE-2026-59095 LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service importFromUrl and topic cover update fetchImageFromUrl...

CVE-2025-13393: Server-Side Request Forgery (SSRF)

The Featured Image from URL FIFU plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.3.1. This is due to insufficient validation of user-supplied URLs before passing them to the getimagesize function in the Elementor widget integration. This...

CVE-2025-7400: Improper Neutralization of Input During Web Page Generation

The Featured Image from URL FIFU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions up to, and including, 5.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2025-9985: Insertion of Sensitive Information into Log File

The Featured Image from URL FIFU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the...

WordPress plugin Featured Image from URL SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A SQL injection...

CVE-2025-9984: Missing Authorization

The Featured Image from URL FIFU plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifuapidebugposts function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protect...

CVE-2025-10037: Improper Neutralization of Special Elements used in an SQL Command

The Featured Image from URL FIFU plugin for WordPress is vulnerable to SQL Injection via the getpostswithinternalfeaturedimage function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2025-10036: Improper Neutralization of Special Elements used in an SQL Command

The Featured Image from URL FIFU plugin for WordPress is vulnerable to SQL Injection via the getallurls function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2022-2278

The Featured Image from URL FIFU WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite...

WordPress Save & Import Image from URL Plugin <= 0.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Save & Import Image from URL versions = 0.7...

CVE-2024-37276

CVE-2024-37276 concerns the WordPress plugin Featured Image from URL (FIFU). Public records show a Missing Authorization vulnerability allowing exploitation of incorrectly configured access control security levels in the FIFU component that handles Featured Image from URL. Affected versions are l...

PT-2024-15760 · WordPress · The Ai Engine: Chatbots

Name of the Vulnerable Software and Affected Versions: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress versions up to, and including, 2.1.4 Description: The issue is related to arbitrary file uploads due to missing file type validation in the add image from u...

WordPress plugin Featured Image from URL (FIFU) 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...