¿Es seguro Featured Image From Url?

Qué hace este plugin

• Slug: featured-image-from-url
• 70000+ instalaciones activas

featuredimageurlvideowoocommerce

Estado de mantenimiento

• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

10 CVEs conocidos registrados para Featured Image From Url.

CVE-2025-13393

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.3.1. This is due to insufficient validation of user-supplied URLs before passing them to the getimagesize() function in the Elementor widget integration. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via the fifu_input_url parameter in the FIFU Elementor widget granted they have permissions to use Elementor.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-10037

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_posts_with_internal_featured_image() function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-10036

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_all_urls() function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-37516

The Featured Image from URL plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the fifu_get_private_data_permissions_check() function in versions up to, and including, 4.8.2. This makes it possible for authenticated attackers, with contributor-level access and above, to utilize several REST API endpoints.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-37276

The Featured Image from URL plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fifu_save_sizes_api() function in versions up to, and including, 4.8.1. This makes it possible for unauthenticated attackers to update size settings.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-1496

No patched version available. Nikolas discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Featured Image from URL Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-6561

Update the WordPress Featured Image from URL plugin to the latest available version (at least 4.5.4). Webbernaut discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Featured Image from URL Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.5.4. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-2278

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘input’ parameter in versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 7 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2022-2241	Featured Image from URL (FIFU) [featured-image-from-url] < 4.0.0	Codificación o escapado incorrecto de la salida	Media 6,1	< 4.0.0	4.0.0	2022-06-30	—
—	Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8	—	Desconocido	< 2.7.8	2.7.8	2019-12-27	—
—	Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8	—	Desconocido	< 2.7.8	2.7.8	2019-12-24	—
CVE-2025-7400	Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,4	< 5.2.8	5.2.8	0000-00-00	—
—	Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8	Inserción de información sensible en un archivo de registro (log)	Media 5,3	< 5.2.8	5.2.8	0000-00-00	—
—	Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8	Falta de control de autorización	Media 5,3	< 5.2.8	5.2.8	0000-00-00	—
—	Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8	—	Desconocido	< 2.7.8	2.7.8	—	—

CVE-2022-2241

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.9. This is due to missing or incorrect nonce validation on the fifu_update_menu_options function. This makes it possible for unauthenticated attackers to trigger plugin options updates via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8

Missing Access Controls on REST routes vulnerability found in WordPress Featured Image from URL plugin (versions <= 2.7.7).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8

The Feature Image from URL plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on REST routes in versions up to, and including, 2.7.7. This makes it possible for unauthenticated attackers to access the vulnerable endpoints.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-7400

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions up to, and including, 5.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 5.2.2.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_posts() function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protected posts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8

The REST routes are missing permission callbacks, allowing unauthenticated/unauthorised users to call them.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Imsanity — 200000+ instalaciones activas — 98/100 (292) — PHP máx. 8.4
• Firelight Lightbox — 200000+ instalaciones activas — 96/100 (351) — PHP máx. 8.4
• Responsive Lightbox & Gallery — 100000+ instalaciones activas — 98/100 (1999) — PHP máx. 8.4
• Simple Lightbox — 100000+ instalaciones activas — 86/100 (238) — PHP máx. <8.0
• reSmush.it : The original free image compressor and optimizer plugin — 100000+ instalaciones activas — 86/100 (162)