PLUGIN SECURITY
Is Featured Image From Url safe?
Use external image URLs for WordPress featured images and WooCommerce product images. No uploads required. FIFU PRO adds videos and galleries.
What this plugin does
- Slug:
featured-image-from-url - Author: fifu.app
- 60000+ active installs
- 92/100 rating (264 reviews on wordpress.org)
- 7533152 all-time downloads
- On WordPress.org since 2015-10-03
external imagefeatured imageimage urlproduct imageremote image
Maintenance status
- Latest known version: 6.0.0
- Last updated: 2026-11-06 3:43pm GMT
- Tested up to WordPress: 7.2
- Requires PHP: 8.1+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
16 known CVEs on file for Featured Image From Url.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-96671 | Featured Image from URL (FIFU) [featured-image-from-url] < 6.0.8 | — | High 8.8 | < 6.0.8 | 6.0.8 | 2026-10-09 | ⚠ update needed |
| CVE-2026-123476 | Featured Image from URL (FIFU) [featured-image-from-url] < 6.1.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 6.1.5 | 6.1.5 | 2026-10-03 | ⚠ update needed |
| CVE-2026-101147 | Featured Image from URL (FIFU) [featured-image-from-url] < 6.0.8 | Cross-Site Request Forgery (CSRF) | Unknown | < 6.0.8 | 6.0.8 | 2026-10-01 | ⚠ update needed |
| CVE-2026-73340 | Featured Image from URL (FIFU) [featured-image-from-url] < 6.0.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 6.0.0 | 6.0.0 | 2026-08-12 | ✓ fixed in latest |
| CVE-2025-13393 | Featured Image from URL (FIFU) [featured-image-from-url] < 5.3.2 | Server-Side Request Forgery (SSRF) | Medium 4.3 | < 5.3.2 | 5.3.2 | 2026-01-09 | ✓ fixed in latest |
| CVE-2025-10037 | Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 4.9 | < 5.2.8 | 5.2.8 | 2025-09-25 | ✓ fixed in latest |
| CVE-2025-10036 | Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 4.9 | < 5.2.8 | 5.2.8 | 2025-09-25 | ✓ fixed in latest |
| CVE-2024-37516 | Featured Image from URL (FIFU) [featured-image-from-url] < 4.8.3 | Missing Authorization | Medium 6.3 | < 4.8.3 | 4.8.3 | 2024-07-05 | ✓ fixed in latest |
+ 15 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-37276 | Featured Image from URL (FIFU) [featured-image-from-url] < 4.8.2 | Missing Authorization | Medium 5.3 | < 4.8.2 | 4.8.2 | 2024-06-28 | ✓ fixed in latest |
| CVE-2024-1496 | Featured Image from URL (FIFU) [featured-image-from-url] < 4.6.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.6.3 | 4.6.3 | 2024-02-19 | ✓ fixed in latest |
| CVE-2023-6561 | Featured Image from URL (FIFU) [featured-image-from-url] < 4.5.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.5.4 | 4.5.4 | 2023-12-14 | ✓ fixed in latest |
| CVE-2022-2278 | Featured Image from URL (FIFU) [featured-image-from-url] < 4.0.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 4.0.1 | 4.0.1 | 2022-07-05 | ✓ fixed in latest |
| CVE-2022-2241 | Featured Image from URL (FIFU) [featured-image-from-url] < 4.0.0 | Improper Encoding or Escaping of Output | Medium 6.1 | < 4.0.0 | 4.0.0 | 2022-06-30 | ✓ fixed in latest |
| — | Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8 | — | Unknown | < 2.7.8 | 2.7.8 | 2019-12-27 | ✓ fixed in latest |
| — | Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8 | — | Unknown | < 2.7.8 | 2.7.8 | 2019-12-24 | ✓ fixed in latest |
| — | Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 5.2.8 | 5.2.8 | 0000-00-00 | ✓ fixed in latest |
| — | Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8 | Insertion of Sensitive Information into Log File | Medium 5.3 | < 5.2.8 | 5.2.8 | 0000-00-00 | ✓ fixed in latest |
| — | Featured Image from URL (FIFU) [featured-image-from-url] < 5.2.8 | Missing Authorization | Medium 5.3 | < 5.2.8 | 5.2.8 | 0000-00-00 | ✓ fixed in latest |
| — | Featured Image from URL (FIFU) [featured-image-from-url] < 2.7.8 | — | Unknown | < 2.7.8 | 2.7.8 | — | ✓ fixed in latest |
| — | Featured Image from URL <= 2.7.7 - Missing Access Controls on REST routes | — | Unknown | < 2.7.8 | 2.7.8 | — | ✓ fixed in latest |
| CVE-2025-9984 | Featured Image from URL (FIFU) < 5.2.8 - Missing Authorization to Password Protected Post Disclosure | — | Unknown | < 5.2.8 | 5.2.8 | — | ✓ fixed in latest |
| CVE-2025-9985 | Featured Image from URL (FIFU) < 5.2.8 - Unauthenticated Information Exposure via Log File | — | Unknown | < 5.2.8 | 5.2.8 | — | ✓ fixed in latest |
| CVE-2025-7400 | Featured Image from URL (FIFU) < 5.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields | — | Unknown | < 5.2.8 | 5.2.8 | — | ✓ fixed in latest |
How to fix it
Keep Featured Image From Url updated — 6.0.0 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Recent Posts Widget With Thumbnails — 100000+ active installs — 96/100 (215) — max PHP 8.4
- Quick Featured Images — 50000+ active installs — 94/100 (235) — max PHP 8.4
- Auto Featured Image (Auto Post Thumbnail) — 40000+ active installs — 76/100 (119) — max PHP 8.4
- Conditionally display featured image on singular posts and pages — 30000+ active installs — 96/100 (38)
- XO Featured Image Tools — 20000+ active installs — 94/100 (21)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.