Featured Image From Url Vulnerabilities

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary we...

CVSS:

6.4

Affected:

up to 5.3.3

Fixed in:

6.0.0

Disclosed:

Aug 12, 2026

CVE-2026-73340 on NVD →

[en] The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.3.1. This is due to insufficient validation of user-supplied URLs before passing them to the getimagesize() function in the Elementor widget integration. This makes it possib...

Affected:

up to 5.3.2

Fixed in:

5.3.2

Disclosed:

Jan 10, 2026

CVE-2025-13393 on NVD →

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.3.1. This is due to insufficient validation of user-supplied URLs before passing them to the getimagesize() function in the Elementor widget integration. This makes it possible fo...

CVSS:

4.3

Affected:

up to 5.3.1

Fixed in:

5.3.2

Disclosed:

Jan 9, 2026

CVE-2025-13393 on NVD →

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions up to, and including, 5.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-leve...

CVSS:

6.4

Affected:

up to 5.2.7

Fixed in:

5.2.8

Disclosed:

Oct 6, 2025

CVE-2025-7400 on NVD →

[en] The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_all_urls() function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for au...

Affected:

up to 5.2.8

Fixed in:

5.2.8

Disclosed:

Sep 26, 2025

CVE-2025-10036 on NVD →

[en] The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_posts_with_internal_featured_image() function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

Affected:

up to 5.2.8

Fixed in:

5.2.8

Disclosed:

Sep 26, 2025

CVE-2025-10037 on NVD →

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_posts() function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protected posts.

CVSS:

5.3

Affected:

up to 5.2.7

Fixed in:

5.2.8

Disclosed:

Sep 25, 2025

CVE-2025-9984 on NVD →

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.

CVSS:

5.3

Affected:

up to 5.2.7

Fixed in:

5.2.8

Disclosed:

Sep 25, 2025

CVE-2025-9985 on NVD →

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_posts_with_internal_featured_image() function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This mak...

CVSS:

4.9

Affected:

up to 5.2.7

Fixed in:

5.2.8

Disclosed:

Sep 25, 2025

CVE-2025-10037 on NVD →

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_all_urls() function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authent...

CVSS:

4.9

Affected:

up to 5.2.7

Fixed in:

5.2.8

Disclosed:

Sep 25, 2025

CVE-2025-10036 on NVD →

[en] Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.2.

Affected:

up to 4.8.3

Fixed in:

4.8.3

Disclosed:

Nov 1, 2024

CVE-2024-37516 on NVD →

[en] Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.1.

Affected:

up to 4.8.2

Fixed in:

4.8.2

Disclosed:

Nov 1, 2024

CVE-2024-37276 on NVD →

The Featured Image from URL plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the fifu_get_private_data_permissions_check() function in versions up to, and including, 4.8.2. This makes it possible for authenticated attackers, with contributor-level access...

CVSS:

4.3

Affected:

up to 4.8.2

Fixed in:

4.8.3

Disclosed:

Jul 5, 2024

CVE-2024-37516 on NVD →

The Featured Image from URL plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fifu_save_sizes_api() function in versions up to, and including, 4.8.1. This makes it possible for unauthenticated attackers to update size settings.

CVSS:

5.3

Affected:

up to 4.8.1

Fixed in:

4.8.2

Disclosed:

Jun 28, 2024

CVE-2024-37276 on NVD →

[en] The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fifu_input_url parameter in all versions up to, and including, 4.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access o...

Affected:

up to 4.6.3

Fixed in:

4.6.3

Disclosed:

Feb 20, 2024

CVE-2024-1496 on NVD →

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fifu_input_url parameter in all versions up to, and including, 4.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or hig...

CVSS:

6.4

Affected:

up to 4.6.2

Fixed in:

4.6.3

Disclosed:

Feb 19, 2024

CVE-2024-1496 on NVD →

[en] The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acc...

Affected:

up to 4.5.4

Fixed in:

4.5.4

Disclosed:

Jan 11, 2024

CVE-2023-6561 on NVD →

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

CVSS:

6.4

Affected:

up to 4.5.3

Fixed in:

4.5.4

Disclosed:

Dec 14, 2023

CVE-2023-6561 on NVD →

[en] The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 4.0.1

Fixed in:

4.0.1

Disclosed:

Aug 1, 2022

CVE-2022-2278 on NVD →

[en] The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of validation, sanitisation and escaping in some of them, it could also le...

Affected:

up to 4.0.0

Fixed in:

4.0.0

Disclosed:

Aug 1, 2022

CVE-2022-2241 on NVD →

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘input’ parameter in versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execu...

CVSS:

5.5

Affected:

up to 4.0.0

Fixed in:

4.0.1

Disclosed:

Jul 5, 2022

CVE-2022-2278 on NVD →

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.9. This is due to missing or incorrect nonce validation on the fifu_update_menu_options function. This makes it possible for unauthenticated attackers to trigger plugin options updat...

CVSS:

8.8

Affected:

up to 3.9.9

Fixed in:

4.0.0

Disclosed:

Jun 30, 2022

CVE-2022-2241 on NVD →

Missing Access Controls on REST routes vulnerability found in WordPress Featured Image from URL plugin (versions <= 2.7.7).

Affected:

up to 2.7.8

Fixed in:

2.7.8

Disclosed:

Dec 27, 2019

The Feature Image from URL plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on REST routes in versions up to, and including, 2.7.7. This makes it possible for unauthenticated attackers to access the vulnerable endpoints.

CVSS:

7.3

Affected:

up to 2.7.7

Fixed in:

2.7.8

Disclosed:

Dec 24, 2019

The Feature Image from URL plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on REST routes in versions up to, and including, 2.7.7. This makes it possible for unauthenticated attackers to access the vulnerable endpoints.

Affected:

up to 2.7.8

Fixed in:

2.7.8

Disclosed:

Dec 24, 2019

The REST routes are missing permission callbacks, allowing unauthenticated/unauthorised users to call them.

Affected:

up to 2.7.8

Fixed in:

2.7.8

Affected:

up to 5.2.8

Fixed in:

5.2.8

CVE-2025-7400 on NVD →

Affected:

up to 5.2.8

Fixed in:

5.2.8

CVE-2025-9985 on NVD →

Affected:

up to 5.2.8

Fixed in:

5.2.8

CVE-2025-9984 on NVD →