CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26008 – WordPress Top 10 Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-26008
22 Feb 2023 — Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ajay D'Souza Top 10 – Popular posts plugin for WordPress plugin <= 3.2.4 versions. The Top 10 – Popular posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will ... • https://patchstack.com/database/vulnerability/top-10/wordpress-top-10-plugin-3-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4570 – Top 10 < 3.2.3 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2022-4570
29 Dec 2022 — The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. El complemento Top 10 de WordPress anterior a 3.2.3 no valida ni escapa algunos de sus atributos de bloque antes de devolverlos a la página, lo que podría permitir a los usuarios con un rol tan bajo com... • https://wpscan.com/vulnerability/a2483ecf-42a6-470a-b965-4e05069d1cef • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •