Featured Image from URL (FIFU)

Explore Featured Image from URL (FIFU) vulnerabilities across all versions. Currently tracking 13 known vulnerabilities, including severity, impact, and patch status.

01234567891003.10.2015Today24.12.20197.3Featured Image from URL <= 2.7.7 - Missing Authorization on REST API routes CVSS 7.3 · 24.12.201930.06.20228.8Featured Image from URL (FIFU) <= 3.9.9 - Cross-Site Request Forgery CVSS 8.8 · 30.06.202205.07.20225.5Featured Image from URL (FIFU) <= 4.0.0 - Stored Cross-Site Scripting CVSS 5.5 · 05.07.202214.12.20236.4Featured Image from URL (FIFU) <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt text CVSS 6.4 · 14.12.202319.02.20246.4Featured Image from URL (FIFU) <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url CVSS 6.4 · 19.02.202428.06.20245.3Featured Image from URL <= 4.8.1 - Missing Authorization CVSS 5.3 · 28.06.202405.07.20244.3Featured Image from URL <= 4.8.2 - Missing Authorization CVSS 4.3 · 05.07.202425.09.20254.9Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection CVSS 4.9 · 25.09.20255.3Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File CVSS 5.3 · 25.09.20254.9Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection CVSS 4.9 · 25.09.20255.3Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure CVSS 5.3 · 25.09.202506.10.20256.4Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields CVSS 6.4 · 06.10.202509.01.20264.3Featured Image from URL (FIFU) <= 5.3.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url' CVSS 4.3 · 09.01.2026

Strategic Overview

Avg CVSSMedium
5.8/ 10
Patch Coverage100%
Open

0

Fixed

13

Get automatic notifications for all Featured Image from URL (FIFU) vulnerabilities before they are exploited.

Vulnerability Records

13 records
2026-01-09 00:00CVE-2025-13393
4.3
Medium
Dmitrii IgnatyevYes
2025-10-06 00:00CVE-2025-7400
6.4
Medium
Muhammad Yudha - DJYes
2025-09-25 16:00CVE-2025-9984
5.3
Medium
ifoundbugYes
2025-09-25 00:00CVE-2025-10037
4.9
Medium
ifoundbugYes
2025-09-25 00:00CVE-2025-9985
5.3
Medium
ifoundbugYes
2025-09-25 00:00CVE-2025-10036
4.9
Medium
ifoundbugYes
2024-07-05 00:00CVE-2024-37516
4.3
Medium
Rafie MuhammadYes
2024-06-28 00:00CVE-2024-37276
5.3
Medium
Rafie MuhammadYes
2024-02-19 00:00CVE-2024-1496
6.4
Medium
NikolasYes
2023-12-14 00:00CVE-2023-6561
6.4
Medium
WebbernautYes
Showing 1–10 of 13 reports
Featured Image from URL (FIFU) banner
Latestv5.3.3

Featured Image from URL (FIFU)

fifu.app

Author

fifu.app

4.6(263)
92/100
Last Updated
2026-02-02 (6mo ago)
Active Installs
70,000+
Downloads
7,233,220
Requires WP
5.6+
Requires PHP
0+
Tested up to
WP 6.9.5
Created
2015-10-03 (11y ago)

WordPress plugin for remote featured images, videos, audios and more FIFU plugin has helped thousands of websites worldwide save money on storage, processing, and copyright since 2015. If you are tired of wasting time and resources with thumbnail regeneration, image optimization, and never-ending imports, this plugin is for you. Featured image Use a remote image as featured image of your post, page or custom post type. Remote featured image Optimized images Make all images square Image search (Unsplash) Default featured image Hide featured media Modify post content Auto set image title Column for featured image [PRO] Image search (search engine) [PRO] Disable right-click [PRO] Save in the media library [PRO] Replace not found image [PRO] Custom popup [PRO] bbPress and BuddyBoss Platform integration [PRO] Page redirection Automatic featured media Auto set featured media from post content [PRO] Auto set featured image using post title and a search engine [PRO] Auto set featured media using web page address [PRO] Auto set product images from ASIN [PRO] Auto set featured media from custom field [PRO] Auto set featured image using ISBN [PRO] Auto set screenshot as featured image [PRO] Auto set featured image from Unsplash using tags [PRO] Auto-share on social media Automation WP-CLI integration [PRO] Add-on for WP All Import [PRO] WooCommerce import [PRO] WP REST API [PRO] WooCommerce REST API [PRO] Schedule metadata generation WooCommerce Remote product image Lightbox and zoom [PRO] Gallery for remote images [PRO] Gallery for remote videos [PRO] Category images auto set [PRO] Variable product [PRO] Variation image [PRO] Gallery for variation image [PRO] Save in the media library [PRO] FIFU product gallery [PRO] Quick Buy [PRO] Add image to order email Featured video Supports URLs from YouTube, Vimeo, Twitter, 9GAG, Cloudinary, Tumblr, Publitio, JW Player, VideoPress, Sprout, Odysee, Rumble, Dailymotion, Cloudflare Stream, Bunny Stream, Amazon, BitChute, Brighteon, Google Drive, Spotify and SoundCloud. External and local video files are supported as well. [PRO] Featured video [PRO] Watch later [PRO] Video thumbnail [PRO] Play button [PRO] Minimum width [PRO] Video controls [PRO] Autoplay on mouseover [PRO] Autoplay [PRO] Playback loop [PRO] Mute [PRO] Privacy enhanced mode [PRO] Background video Widgets for Elementor Featured image [PRO] Featured video Widgets for WordPress [PRO] Featured media [PRO] Featured grid [PRO] Product gallery Fields for Gravity-Forms Featured image [PRO] Featured video [PRO] Featured slider Fields for Dokan Featured image [PRO] Product gallery Others [PRO] Quick edit [PRO] Featured audio [PRO] Featured slider [PRO] Shortcode [PRO] Taxonomy image Functions for developers fifu_dev_set_image($post_id, $image_url) [PRO] fifu_dev_set_video($post_id, $video_url) [PRO] fifu_dev_set_slider($post_id, $url_list, $alt_list) [PRO] fifu_dev_set_image_list($post_id, $image_url_list) [PRO] fifu_dev_set_video_list($post_id, $video_url_list) [PRO] fifu_dev_set_category_image($term_id, $image_url) [PRO] fifu_dev_set_category_video($term_id, $video_url) FIFU Cloud Cloud storage (never lose an image again) Global CDN (images loaded much faster) Optimized thumbnails (processed in the cloud) Usage-based billing (per stored image) Smart cropping (detects people and objects before cropping) Hotlink protection (sites can’t embed your images) Links FIFU PRO Dummy site for testing Extension for Google Chrome Smoke Test

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C