CVE-2025-5818: Server-Side Request Forgery (SSRF)

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.6 via the fipgetimageoptions function. This makes it possible for authenticated attackers, with administrator-level access and abov...

CVE-2025-4431: Improper Access Control

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fipsaveattachfeatured function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers...

CVE-2011-0700

Multiple cross-site scripting XSS vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to 1 the Quick/Bulk Edit title aka post title or posttitle, 2 poststatus, 3 commentstatus, 4 pingstatus, and 5 escaping of tags...

PT-2011-2569

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.0.5 Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This is achieved through various vectors, including the Quick/Bulk Edit title, post status, comment status, ping...

WordPress < 3.0.5 Multiple Vulnerabilities

According to its version number, the installation of WordPress hosted on the remote web server is affected by multiple vulnerabilities : - The application is prone to multiple cross-site scripting vulnerabilities. An attacker can exploit these issues through the 'title' field of the 'Quick/Bulk...