Featured Image from URL (FIFU)
Featured Image from URL (FIFU) has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; all 14 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2025 was the busiest year with 5 disclosures.
The most common weakness is Cross-Site Scripting, behind 5 of the records (36%). Other recurring categories include Missing Authorization, SQL Injection.
Every one of the 14 issues recorded for Featured Image from URL (FIFU) has a vendor fix available, so running the current release closes all known holes.
8 independent researchers contributed these findings, most of them (4) reported by ifoundbug. Featured Image from URL (FIFU) is installed on roughly 60,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2022-2241Featured Image from URL (FIFU) <= 3.9.9 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
Featured Image from URL (FIFU)
Author
fifu.app
WordPress plugin for remote featured images and more FIFU has helped thousands of websites worldwide save storage, processing resources, and time since 2015. If you are tired of wasting time and resources with thumbnail regeneration, image optimization, and never-ending imports, this plugin is for you. Featured image Use a remote image as the featured image of your post, page, custom post type, or WooCommerce product. Remote featured image Featured image alternative text Optimized images Make all images square Image search with Unsplash Default featured image Hide featured media Modify post content Auto set image title Featured image column Quick Edit [PRO] Image search with a search engine [PRO] Disable right-click [PRO] Save in the media library [PRO] Replace not found image [PRO] Custom popup [PRO] bbPress and BuddyBoss Platform integration [PRO] Page redirection Category image Use a remote image for categories and other supported taxonomy terms. Remote category image Category image alternative text Automatic featured media Auto set featured media from post content [PRO] Auto set featured image using post title and a search engine [PRO] Auto set featured media using web page address [PRO] Auto set product images from ASIN [PRO] Auto set featured media from custom field [PRO] Auto set screenshot as featured image [PRO] Auto-share on social media Automation WP-CLI integration Developer functions [PRO] Add-on for WP All Import [PRO] WooCommerce import [PRO] Advanced REST API integrations WooCommerce Remote product image Lightbox and zoom Remote product category image [PRO] Gallery for remote images [PRO] Gallery for remote videos [PRO] Category images auto set [PRO] Variable product image tools [PRO] Variation image tools [PRO] Gallery for variation images [PRO] Save in the media library [PRO] FIFU product gallery [PRO] Quick Buy [PRO] Add image to order email Featured video The PRO version supports featured videos from services and external video files. [PRO] Featured video [PRO] Watch later [PRO] Video thumbnail [PRO] Play button [PRO] Minimum width [PRO] Video controls [PRO] Autoplay on mouseover [PRO] Autoplay [PRO] Playback loop [PRO] Mute Widgets for Elementor Featured image [PRO] Featured video Fields for Gravity Forms Featured image [PRO] Featured video [PRO] Featured slider Fields for Dokan Featured image [PRO] Product gallery Other PRO features [PRO] Featured audio [PRO] Featured slider [PRO] Image and video galleries [PRO] Shortcodes [PRO] Advanced WooCommerce media features Functions for developers Featured image: fifu_dev_set_image($post_id, $image_url) Product category image: fifu_dev_set_category_image($term_id, $image_url) [PRO] Featured video: fifu_dev_set_video($post_id, $video_url) [PRO] Featured slider: fifu_dev_set_slider($post_id, $url_list, $alt_list) [PRO] Product image + Image gallery: fifu_dev_set_image_list($post_id, $image_url_list) [PRO] Product video + Video gallery: fifu_dev_set_video_list($post_id, $video_url_list) [PRO] Product category video: fifu_dev_set_category_video($term_id, $video_url) FIFU Cloud Cloud storage Global CDN Optimized thumbnails Automatic cloud upload and deletion scheduling Hotlink protection Links FIFU PRO Dummy site for testing Extension for Google Chrome Smoke Test
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C