OSS Aliyun

OSS Aliyun has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 9.1, and the most serious one scores 9.1 out of 10. Severity breakdown: 1 critical and 0 high.

The most common weakness is SQL Injection, behind 1 of the records (100%).

The one issue recorded for OSS Aliyun has a vendor fix available, so running the current release closes it.

All of these findings were reported by Majed Refaea. OSS Aliyun is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSCritical

9.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all OSS Aliyun vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.1CVE-2024-30494

OSS Aliyun <= 1.4.10 - Authenticated (Administrator+) SQL Injection

Read the full analysis

Vulnerability Records

1 records


2024-03-28 00:00	OSS Aliyun <= 1.4.10 - Authenticated (Administrator+) SQL Injection OSS Aliyun <= 1.4.10	`CVE-2024-30494`	9.1 Critical	Majed Refaea	Yes

Showing 1–1 of 1 reports

Latestv1.5.4

OSS Aliyun

Author

沈唁

4.8(5)

96/100

Last Updated

2026-07-02 (2mo ago)

Active Installs

4,000+

Downloads

38,014

Requires WP

4.6+

Requires PHP

7.1+

Tested up to

WP 7.0.4

Created

2020-03-31 (7y ago)

使用阿里云对象存储 OSS 作为附件存储空间。(This is a plugin that uses Aliyun Object Storage Service for attachments remote saving.) 依赖阿里云 OSS 服务：https://www.aliyun.com/product/oss 插件特点可配置是否上传缩略图和是否保留本地备份本地删除可同步删除阿里云对象存储 OSS 中的文件支持阿里云对象存储 OSS 绑定的用户域名支持替换数据库中旧的资源链接地址支持阿里云对象存储 OSS 完整地域使用支持同步历史附件到阿里云对象存储 OSS 支持阿里云 OSS 图片处理支持上传文件自动重命名支持使用 ECS 的 RAM 操作支持原图保护支持 wp-cli 命令上传/删除文件支持多站点支持图片裁剪编辑等操作后的上传插件更多详细介绍和安装：https://github.com/sy-records/aliyun-oss-wordpress 其他插件腾讯云 COS：GitHub，WordPress Plugins 华为云 OBS：GitHub，WordPress Plugins 七牛云 KODO：GitHub，WordPress Plugins 又拍云 USS：GitHub，WordPress Plugins 作者博客沈唁志欢迎加入沈唁的 WordPress 云存储全家桶 QQ 交流群：887595381

View on WordPress.org