CVE-2026-66705 WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Facebook for WordPress = 5.2.1 versions...

CVE-2026-66705 WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Facebook for WordPress = 5.2.1 versions...

PT-2026-68598

Name of the Vulnerable Software and Affected Versions Facebook for WordPress versions prior to 5.2.2 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update Facebook for...

CVE-2026-66705: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Facebook for WordPress = 5.2.1 versions...

CVE-2021-24217

The runaction function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code...

CVE-2021-24218

The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...

Cross site request forgery (csrf)

The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...

CVE-2021-24218: Cross-Site Request Forgery (CSRF)

The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...

CVE-2021-24217: Deserialization of Untrusted Data

The runaction function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code...

PT-2021-15761

Name of the Vulnerable Software and Affected Versions: Facebook for WordPress plugin versions prior to 3.0.0 Description: The issue concerns the run action function, which deserializes user-supplied data, allowing for PHP objects to be supplied and creating an object injection vulnerability...

PT-2021-15762

Name of the Vulnerable Software and Affected Versions: Facebook for WordPress plugin versions prior to 3.0.4 Description: The issue concerns the wp ajax save fbe settings and wp ajax delete fbe settings AJAX actions, which were vulnerable to CSRF due to a lack of nonce protection. Additionally, t...