CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0252 – Contextual Related Posts < 3.3.1 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-0252
05 Jan 2023 — The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in versions up to, and including, 3.3.0 due to insufficient input sanitization and output esc... • https://wpscan.com/vulnerability/5754a4fd-1adf-47aa-976f-3b28750058c2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 31EXPL: 0CVE-2013-2710 – Contextual Related Posts <= 1.8.6 - Cross-Site Request Forgery to Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2013-2710
02 Jun 2014 — Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via unspecified vectors. Vulnerabilidad de CSRF en el plugin Contextual Related Posts anterior a 1.8.7 para WordPress permite a atacantes remotos secuestrar la autenticación de administradores para solicitudes que realizan ataques de XSS a través de vectores no espe... • http://secunia.com/advisories/52960 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 37EXPL: 0CVE-2014-3937 – Contextual Related Posts < 1.8.10.2 - SQL Injection
https://notcve.org/view.php?id=CVE-2014-3937
06 Mar 2014 — SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en el plugin Contextual Related Posts anterior a 1.8.10.2 para WordPress permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://wordpress.org/plugins/contextual-related-posts/changelog • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •