# marceljm Featured Image from URL (FIFU).

Every CVE that names marceljm Featured Image from URL (FIFU) among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Featured Image from URL (FIFU) <= 5.3.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url'](https://agentprime.io/advisories/CVE-2025-13393.md)
  `CVE-2025-13393` · CVE record: marceljm Featured Image from URL (FIFU) · CVSS 4.3 Medium · Not analysed yet · Published 10 Jan 2026 · Tags: Server-side request forgery (SSRF)
- [Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields](https://agentprime.io/advisories/CVE-2025-7400.md)
  `CVE-2025-7400` · CVE record: marceljm Featured Image from URL (FIFU) · CVSS 6.4 Medium · Not analysed yet · Published 7 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection](https://agentprime.io/advisories/CVE-2025-10036.md)
  `CVE-2025-10036` · CVE record: marceljm Featured Image from URL (FIFU) · CVSS 4.9 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: SQL injection
- [Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File](https://agentprime.io/advisories/CVE-2025-9985.md)
  `CVE-2025-9985` · CVE record: marceljm Featured Image from URL (FIFU) · CVSS 5.3 Medium · EPSS 0.13 · Not analysed yet · Published 26 Sept 2025 · Tags: Information disclosure
- [Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure](https://agentprime.io/advisories/CVE-2025-9984.md)
  `CVE-2025-9984` · CVE record: marceljm Featured Image from URL (FIFU) · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Broken access control
- [Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection](https://agentprime.io/advisories/CVE-2025-10037.md)
  `CVE-2025-10037` · CVE record: marceljm Featured Image from URL (FIFU) · CVSS 4.9 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: SQL injection
- [Featured Image from URL (FIFU) <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url](https://agentprime.io/advisories/CVE-2024-1496.md)
  `CVE-2024-1496` · CVE record: marceljm Featured Image from URL (FIFU) · CVSS 6.4 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Featured Image from URL (FIFU) <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt text](https://agentprime.io/advisories/CVE-2023-6561.md)
  `CVE-2023-6561` · CVE record: marceljm Featured Image from URL (FIFU) · CVSS 6.4 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=marceljm-featured-image-from-url-fifu>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/marceljm-featured-image-from-url-fifu/>. Everything for agents: <https://agentprime.io/llms.txt>.