Skip to content
OpenAdvisories

Vendor

marceljm

8 known vulnerabilities.

Products

Featured Image from URL (FIFU) 8
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-13393

    Featured Image from URL (FIFU) <= 5.3.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url'

    The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.3.1. This is due to insufficient validation of user-supplied URLs before passing them to the getimagesize() function i…

    marceljm Featured Image from URL (FIFU) Web / CMS
  • Medium 6.4
    CVE-2025-7400

    Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields

    The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions up to, and including, 5.2.7 due to insufficient input sanitization and output escaping. This makes i…

    marceljm Featured Image from URL (FIFU) Web / CMS
  • Medium 5.3
    CVE-2025-9985 EPSS 13%

    Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File

    The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially se…

    marceljm Featured Image from URL (FIFU) Web / CMS
  • Medium 4.9
    CVE-2025-10036

    Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection

    The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_all_urls() function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o…

    marceljm Featured Image from URL (FIFU) Web / CMS
  • Medium 5.3
    CVE-2025-9984

    Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure

    The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_posts() function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticat…

    marceljm Featured Image from URL (FIFU) Web / CMS
  • Medium 4.9
    CVE-2025-10037

    Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection

    The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_posts_with_internal_featured_image() function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack o…

    marceljm Featured Image from URL (FIFU) Web / CMS
  • Medium 6.4
    CVE-2024-1496

    Featured Image from URL (FIFU) <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url

    The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fifu_input_url parameter in all versions up to, and including, 4.6.2 due to insufficient input sanitization and output escaping. This makes it possibl…

    marceljm Featured Image from URL (FIFU) Web / CMS
  • Medium 6.4
    CVE-2023-6561

    Featured Image from URL (FIFU) <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt text

    The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible…

    marceljm Featured Image from URL (FIFU) Web / CMS