CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3506 – Cross-site Scripting (XSS) - Stored in barrykooij/related-posts-for-wp
https://notcve.org/view.php?id=CVE-2022-3506
Cross-site Scripting (XSS) - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3. Una vulnerabilidad de tipo Cross-site Scripting (XSS) - Almacenado en el repositorio de GitHub barrykooij/related-posts-for-wp versiones anteriores a 2.1.3 The Related Posts for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_text’ parameter in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note, this vulnerability was independently found by two researchers. • https://github.com/barrykooij/related-posts-for-wp/commit/37733398dd88863fc0bdb3d6d378598429fd0b81 https://huntr.dev/bounties/08251542-88f6-4264-9074-a89984034828 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24482 – Related Posts for WordPress <= 2.0.4 - Authenticated Stored XSS & XFS
https://notcve.org/view.php?id=CVE-2021-24482
The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings, allowing high privilege users (admin) to set XSS payloads in them, leading to Stored Cross-Site Scripting issues. El plugin Related Posts para WordPress versiones hasta 2.0.4, no sanea sus ajustes heading_text y CSS, permitiendo a usuarios con privilegios elevados (admin) establecer cargas útiles XSS en ellos, lo que conlleva a problemas de tipo Cross-Site Scripting Almacenado • https://m0ze.ru/vulnerability/%5B2021-04-18%5D-%5BWordPress%5D-%5BCWE-79%5D-Related-Posts-for-WordPress-WordPress-Plugin-v2.0.4.txt https://wpscan.com/vulnerability/2f86e418-22fd-4cb8-8de1-062b17cf20a7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24180 – Related Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24180
Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL. Una entrada no comprobada y una falta de codificación de la salida dentro del plugin Related Posts para WordPress versiones anteriores a 2.0.4, conllevan a una vulnerabilidad de tipo Cross-Site Scripting (XSS) reflejado dentro del parámetro GET "lang" al editar una publicación, desencadenándose cuando unos usuarios presentan la capacidad de editar publicaciones que acceden a una URL maliciosa • https://wpscan.com/vulnerability/7593d5c8-cbc2-4469-b36b-5d4fb6d49718 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9361 – Related Posts <= 1.8.1 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-9361
The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg(). El plugin Related Posts versiones anteriores a 1.8.2 para WordPress, tiene una vulnerabilidad de tipo XSS por medio de las funciones add_query_arg() y remove_query_arg(). • https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html https://www.barrykooij.com/several-security-updates-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •