PT-2025-30511 · WordPress · The Featured Image Plus – Quick & Bulk Edit With Unsplash

Ch4R0N · Published 2025-07-23 · Updated 2025-07-23 · CVE-2025-5818

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Featured Image Plus – Quick & Bulk Edit with Unsplash versions prior to 1.6.4

Description The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is susceptible to Server-Side Request Forgery via the fip get image options() function. This allows authenticated attackers with administrator-level access or higher to initiate web requests to arbitrary locations from the web application. This capability can be used to query and modify information from internal services.

Recommendations Update Featured Image Plus – Quick & Bulk Edit with Unsplash to a version later than 1.6.4.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-5818

Affected Products

The Featured Image Plus – Quick & Bulk Edit With Unsplash

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-5818 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6904f168-e06f-4f17-905b-a943a39dfbdb?source=cve · Note
• https://plugins.trac.wordpress.org/browser/featured-image-plus/trunk/inc/admin/block-editor/block-editor-actions.php#L166 · Note
• https://t.me/CVEtracker/28443 · Telegram Post
• https://t.me/cveNotify/129933 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1948014140703883612 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3331831%40featured-image-plus&new=3331831%40featured-image-plus&sfp_email=&sfph_mail= · Note
• https://t.me/cvetracker/28443 · Telegram Post