CVE-2025-27000 WordPress Simple Photo Feed Plugin <= 1.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in George Pattichis Simple Photo Feed simple-photo-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Photo Feed: from n/a through = 1.4.0...

CVE-2024-11748

CVE-2024-11748 : The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s taeggie-feed shortcode in versions up to 0.1.9 due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires Contributor+ privileges...

PT-2024-17228 · WordPress · Taeggie Feed

Name of the Vulnerable Software and Affected Versions: Taeggie Feed plugin for WordPress versions up to, and including, 0.1.9 Description: The issue is related to stored cross-site scripting via the plugin's 'taeggie-feed' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-16442 · WordPress · The Easy Twitter Feed – Twitter Feeds Plugin For Wp

Name of the Vulnerable Software and Affected Versions: The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress version 1.2.6 and earlier Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from password protected, private,...

PT-2024-17006 · WordPress · Mastodon Feed

Name of the Vulnerable Software and Affected Versions: Include Mastodon Feed plugin for WordPress versions up to, and including, 1.9.5 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the...

WordPress Admin Dashboard RSS Feed plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by younsoung kim, SeoHyeon Lee, MyungJu Kim, SeoHee Kang in WordPress Plugin Admin Dashboard RSS Feed versions = 3.1...

CVE-2024-6256

CVE-2024-6256 affects the WordPress plugin Feeds for YouTube (YouTube video, channel, and gallery). The issue is a Stored XSS in the youtube-feed shortcode caused by insufficient input sanitization and output escaping on user-supplied attributes, exploitable by authenticated attackers with contri...

WordPress HT Feed plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin HT Feed versions = 1.2.8...

CVE-2024-1278

CVE-2024-1278 affects the WordPress plugin “Easy Social Feed – Social Photos Gallery – Post Feed – Like Box.” The vulnerability is Stored XSS through the plugin’s shortcodes, specifically the efb_likebox shortcode, in all versions up to 6.5.4. The root cause is insufficient input sanitization and...

CVE-2023-47522

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Photo Feed plugin = 2.2.1 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Photo Feed plugin = 2.2.1 versions...

CVE-2023-47522 WordPress Photo Feed Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Photo Feed plugin = 2.2.1 versions...

CVE-2023-47522 WordPress Photo Feed Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Photo Feed plugin = 2.2.1 versions...

CVE-2023-47522

CVE-2023-47522 is a reflected, unauthenticated XSS vulnerability in the Photo Feed WordPress plugin prior to version 2.2.1. The issue is triggered via the pf-gid parameter, enabling attacker-controlled script execution in a victim’s browser. Affected software: Photo Feed plugin

PT-2023-30483 · Unknown · Photo Feed

Name of the Vulnerable Software and Affected Versions: Photo Feed plugin versions prior to 2.2.1 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website, potentially allowing them t...

Cross site scripting

The Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialfeed' shortcode in all versions up to, and including, 1.5.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2023-5661 Social Feed <= 1.5.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode

The Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialfeed' shortcode in all versions up to, and including, 1.5.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Plugin Social Feed Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress Photo Feed Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Photo Feed Type Plugin Vulnerable versions = 2.2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-47522 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c41c9fcd587f Credits Le Ngoc Anh Required...

CVE-2023-5082

The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when using the Smash Balloon Social Photo Feed plugin alongside it...