Is Featured Image From Url safe?

What this plugin does

• Slug: featured-image-from-url
• 70000+ active installs

featuredimageurlvideowoocommerce

Maintenance status

• Max supported PHP (analyzed): 8.4

Known vulnerabilities

10 known CVEs on file for Featured Image From Url.

CVE-2025-13393

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.3.1. This is due to insufficient validation of user-supplied URLs before passing them to the getimagesize() function in the Elementor widget integration. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via the fifu_input_url parameter in the FIFU Elementor widget granted they have permissions to use Elementor.

Source: CVE.org

CVE-2025-10037

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_posts_with_internal_featured_image() function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Source: CVE.org

CVE-2025-10036

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_all_urls() function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Source: CVE.org

CVE-2024-37516

The Featured Image from URL plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the fifu_get_private_data_permissions_check() function in versions up to, and including, 4.8.2. This makes it possible for authenticated attackers, with contributor-level access and above, to utilize several REST API endpoints.

Source: Wordfence

CVE-2024-37276

The Featured Image from URL plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fifu_save_sizes_api() function in versions up to, and including, 4.8.1. This makes it possible for unauthenticated attackers to update size settings.

Source: Wordfence

CVE-2024-1496

No patched version available. Nikolas discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Featured Image from URL Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet. Have additional information or questions about this entry? Get in touch.

Source: Patchstack

CVE-2023-6561

Update the WordPress Featured Image from URL plugin to the latest available version (at least 4.5.4). Webbernaut discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Featured Image from URL Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.5.4. Have additional information or questions about this entry? Get in touch.

Source: Patchstack

CVE-2022-2278

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘input’ parameter in versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page

Source: Wordfence

+ 7 more known vulnerabilities

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2022-2241	Featured Image from URL (FIFU) [featured-image-from-url] < 4.0.0	Improper Encoding or Escaping of Output	Medium 6.1	< 4.0.0	4.0.0	2022-06-30	—
—	Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8	—	Unknown	< 2.7.8	2.7.8	2019-12-27	—
—	Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8	—	Unknown	< 2.7.8	2.7.8	2019-12-24	—
CVE-2025-7400	Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 6.4	< 5.2.8	5.2.8	0000-00-00	—
—	Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8	Insertion of Sensitive Information into Log File	Medium 5.3	< 5.2.8	5.2.8	0000-00-00	—
—	Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8	Missing Authorization	Medium 5.3	< 5.2.8	5.2.8	0000-00-00	—
—	Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8	—	Unknown	< 2.7.8	2.7.8	—	—

CVE-2022-2241

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.9. This is due to missing or incorrect nonce validation on the fifu_update_menu_options function. This makes it possible for unauthenticated attackers to trigger plugin options updates via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Source: Wordfence

Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8

Missing Access Controls on REST routes vulnerability found in WordPress Featured Image from URL plugin (versions <= 2.7.7).

Source: Patchstack

Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8

The Feature Image from URL plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on REST routes in versions up to, and including, 2.7.7. This makes it possible for unauthenticated attackers to access the vulnerable endpoints.

Source: Wordfence

CVE-2025-7400

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions up to, and including, 5.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 5.2.2.

Source: Wordfence

Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.

Source: CVE.org

Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_posts() function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protected posts.

Source: CVE.org

Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8

The REST routes are missing permission callbacks, allowing unauthenticated/unauthorised users to call them.

Source: WPScan

How to fix it

Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.

This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.

Safer / more established alternatives

• Imsanity — 200000+ active installs — 98/100 (292) — max PHP 8.4
• Firelight Lightbox — 200000+ active installs — 96/100 (351) — max PHP 8.4
• Responsive Lightbox & Gallery — 100000+ active installs — 98/100 (1999) — max PHP 8.4
• Simple Lightbox — 100000+ active installs — 86/100 (238) — max PHP <8.0
• reSmush.it : The original free image compressor and optimizer plugin — 100000+ active installs — 86/100 (162)