What’s Vulnerable › Products

marceljm Featured Image from URL (FIFU) vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your marceljm Featured Image from URL (FIFU) version is affected

Latest marceljm Featured Image from URL (FIFU) vulnerabilities

• CVE-2026-101147 — Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF (CVSS 8.8)
• CVE-2025-13393 — Featured Image from URL (FIFU) <= 5.3.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url' (CVSS 4.3)
• CVE-2025-7400 — Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields (CVSS 6.4)
• CVE-2025-9985 — Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File (CVSS 5.3)
• CVE-2025-9984 — Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure (CVSS 5.3)
• CVE-2025-10037 — Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection (CVSS 4.9)
• CVE-2025-10036 — Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection (CVSS 4.9)
• CVE-2024-37276 — WordPress Featured Image from URL (FIFU) plugin <= 4.8.1 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2024-1496 — Featured Image from URL (FIFU) <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url (CVSS 5.4)
• CVE-2023-6561 — Featured Image from URL (FIFU) <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt text (CVSS 5.4)
• CVE-2022-2278 — Featured Image from URL < 4.0.1 - Admin+ Stored Cross-Site Scripting (CVSS 4.8)
• CVE-2022-2241 — Featured Image from URL < 4.0.0 - Arbitrary Settings Update to Stored XSS via CSRF (CVSS 6.1)