Wp Scraper Vulnerabilities

[en] Server-Side Request Forgery (SSRF) vulnerability in extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site allows Server Side Request Forgery.This issue affects WordPress & WooCommerce Scraper Plugin, Import Data from Any Site: from n/a through 1.0.7.

Affected:

up to 1.0.7

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62088 on NVD →

The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wp_scraper_extract_content function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating...

CVSS:

6.8

Affected:

up to 5.8.1

Fixed in:

5.8.2

Disclosed:

Oct 10, 2025

CVE-2025-9975 on NVD →

[en] Server-Side Request Forgery (SSRF) vulnerability in Robert Macchi WP Scraper.This issue affects WP Scraper: from n/a through 5.7.

Affected:

up to 5.8.1

Fixed in:

5.8.1

Disclosed:

Jul 6, 2024

CVE-2024-37208 on NVD →

The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to qu...

CVSS:

6.4

Affected:

up to 5.8

Fixed in:

5.8.1

Disclosed:

Jun 20, 2024

CVE-2024-37208 on NVD →

[en] The WP Scraper plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_scraper_multi_scrape_action() function in all versions up to, and including, 5.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary page...

Affected:

up to 5.8

Fixed in:

5.8

Disclosed:

May 22, 2024

CVE-2024-3663 on NVD →

The WP Scraper plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_scraper_multi_scrape_action() function in all versions up to, and including, 5.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary pages and...

CVSS:

4.3

Affected:

up to 5.7

Fixed in:

5.8

Disclosed:

May 21, 2024

CVE-2024-3663 on NVD →