Featured Image From Url (Fifu)
Approved changes feed: RSS · Atom
cpe:2.3:a:marceljm:featured_image_from_url_(fifu):*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Marceljm (f88b81ac-74cc-5f9c-85a3-f442bb625f97) |
|---|---|
| Product | Featured Image From Url (Fifu) (6a8800ab-88bd-51e4-bb4e-1540062c7243) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-9985 |
vulnerable | 2026-06-08 07:47:10.408177 |
Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
MEDIUM (5.3)
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.
Published: 2025-09-26T04:25:17.076Z
Updated: 2026-04-08T17:10:48.643Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9984 |
vulnerable | 2026-06-08 07:47:10.407786 |
Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure
MEDIUM (5.3)
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_posts() function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protected posts.
Published: 2025-09-26T04:25:16.647Z
Updated: 2026-04-08T17:09:48.955Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-7400 |
vulnerable | 2026-06-08 07:43:18.467557 |
Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields
MEDIUM (6.4)
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions up to, and including, 5.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 5.2.2.
Published: 2025-10-07T07:22:39.716Z
Updated: 2026-04-08T17:13:10.661Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13393 |
vulnerable | 2026-06-08 07:04:32.128052 |
Featured Image from URL (FIFU) <= 5.3.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url'
MEDIUM (4.3)
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.3.1. This is due to insufficient validation of user-supplied URLs before passing them to the getimagesize() function in the Elementor widget integration. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via the fifu_input_url parameter in the FIFU Elementor widget granted they have permissions to use Elementor.
Published: 2026-01-10T13:47:35.750Z
Updated: 2026-04-08T17:17:36.479Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-10037 |
vulnerable | 2026-06-08 07:02:26.196996 |
Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection
MEDIUM (4.9)
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_posts_with_internal_featured_image() function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-09-26T04:25:16.082Z
Updated: 2026-04-08T16:53:23.901Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-10036 |
vulnerable | 2026-06-08 07:02:26.196577 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1496 |
vulnerable | 2026-06-08 06:25:40.284327 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6561 |
vulnerable | 2026-06-08 06:21:54.875546 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.