CVSS: 8.8EPSS: 0%CPEs: 31EXPL: 0CVE-2013-2710 – Contextual Related Posts <= 1.8.6 - Cross-Site Request Forgery to Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2013-2710
Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via unspecified vectors. Vulnerabilidad de CSRF en el plugin Contextual Related Posts anterior a 1.8.7 para WordPress permite a atacantes remotos secuestrar la autenticación de administradores para solicitudes que realizan ataques de XSS a través de vectores no especificados. • http://secunia.com/advisories/52960 http://wordpress.org/plugins/contextual-related-posts/changelog http://www.securityfocus.com/bid/59733 https://exchange.xforce.ibmcloud.com/vulnerabilities/84100 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 37EXPL: 0CVE-2014-3937 – Contextual Related Posts < 1.8.10.2 - SQL Injection
https://notcve.org/view.php?id=CVE-2014-3937
SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en el plugin Contextual Related Posts anterior a 1.8.10.2 para WordPress permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://wordpress.org/plugins/contextual-related-posts/changelog • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •