{"id":"CVE-2022-1037","aliases":["EUVD-2022-24384","GHSA-52rg-37rg-rfhm"],"status":"published","title":"EXMAGE \u003c 1.0.7 - Admin+ Blind SSRF","description":"The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local URLs","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01334,"percentile":0.71393,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2022-04-18T17:10:46Z","modified":"2026-06-17T04:21:41Z","products":[{"vendor":"unknown","product":"exmage – wordpress image links"},{"vendor":"villatheme","product":"exmage"}],"references":[{"url":"https://wpscan.com/vulnerability/bd8555bd-8086-41d0-a1f7-3557bc3af957","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1037"},{"url":"https://github.com/advisories/GHSA-52rg-37rg-rfhm"}],"sources":{"cve":[{"id":"CVE-2022-1037","title":"EXMAGE \u003c 1.0.7 - Admin+ Blind SSRF","description":"The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local URLs","status":"published","published":"2022-04-18T17:10:46Z","modified":"2024-08-02T23:47:43.287Z","cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:38.263045Z"}],"euvd":[{"id":"EUVD-2022-24384","description":"The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local URLs","status":"published","published":"2022-04-18T17:10:46Z","modified":"2024-08-02T23:47:43Z","updated_at":"2026-11-03T03:26:03.022972Z"}],"ghsa":[{"id":"GHSA-52rg-37rg-rfhm","title":"The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external...","description":"The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local URLs","status":"published","published":"2022-04-19T00:00:46Z","modified":"2023-01-27T05:01:53Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:41:58.86931Z"}],"nvd":[{"id":"CVE-2022-1037","description":"The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local URLs","status":"published","published":"2022-04-18T18:15:08.793Z","modified":"2026-06-17T04:21:41.117Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:07:16.9948Z"}]}}