CVE-2025-24549

CVE-2025-24549: WordPress Post Meta plugin (versions n/a–1.0.9) is affected by a CSRF flaw that enables Reflected XSS. Connected sources indicate affected versions are up to 1.0.9; a patch/update to a fixed version is recommended as remediation. If upgrading, verify the plugin version is beyond 1...

CVE-2025-24549 WordPress Post Meta plugin <= 1.0.9 - Reflected Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Mahbubur Rahman Post Meta post-meta allows Reflected XSS.This issue affects Post Meta: from n/a through = 1.0.9...

WordPress plugin Post Meta 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

PT-2025-5398 · Post Meta · Post Meta

Name of the Vulnerable Software and Affected Versions: Post Meta versions 1.0.9 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Reflected XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

WordPress Post Meta plugin <= 1.0.9 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Post Meta versions = 1.0.9...

CVE-2024-10080

The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-10080

The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

PT-2024-16014 · WordPress · Wp Easy Post Types

Name of the Vulnerable Software and Affected Versions: WP Easy Post Types plugin for WordPress versions up to, and including, 1.4.4 Description: The issue is related to Stored Cross-Site Scripting via post meta due to insufficient input sanitization and output escaping on user-supplied attributes...

WordPress SEO Manager plugin <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Post Meta vulnerability discovered by István Márton in WordPress Plugin SEO Manager versions = 1.9...

CVE-2024-8628

The Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-meta' shortcode in all versions up to, and including, 1.2.70.3 due to insufficient input sanitization and output escaping o...

PT-2024-39142 · WordPress · Mailoptin

Name of the Vulnerable Software and Affected Versions: MailOptin plugin for WordPress versions up to, and including, 1.2.70.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'post-meta' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-21587 · WordPress · Betheme

Name of the Vulnerable Software and Affected Versions: Betheme theme for WordPress versions up to, and including, 27.5.6 Description: The issue is related to PHP Object Injection via deserialization of untrusted input of the mfn-page-items post meta value. This allows authenticated attackers with...

CVE-2024-7561 The Next <= 1.1.0 - Authenticated (Contributor+) PHP Object Injection

The The Next theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from the wpedenpostmeta post meta value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject...

PT-2024-38421 · WordPress · The Next

Name of the Vulnerable Software and Affected Versions: The Next theme for WordPress versions up to, and including, 1.1.0 Description: The issue allows authenticated attackers with Contributor-level access and above to inject a PHP Object via deserialization of untrusted input from the wpeden post...

PT-2024-38377 · WordPress · Multipurpose

Name of the Vulnerable Software and Affected Versions: MultiPurpose theme for WordPress versions up to, and including, 1.2.0 Description: The issue allows authenticated attackers with Contributor-level access and above to inject a PHP Object via deserialization of untrusted input through the wped...

PT-2024-38420 · WordPress · The News Flash

Name of the Vulnerable Software and Affected Versions: The News Flash theme for WordPress versions up to, and including, 1.1.0 Description: The issue allows authenticated attackers with Editor-level access and above to inject a PHP Object via deserialization of untrusted input from the newsflash...

CVE-2024-2508 WP Mobile Menu <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modification

The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savemenuitemicon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the 'mobmenuicon' post meta to...

WordPress WP Mobile Menu plugin <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modification vulnerability

Missing Authorization to mobmenuicon Post Meta Modification vulnerability discovered by 1337Wannabe in WordPress Plugin WP Mobile Menu versions = 2.8.4.4...

PT-2024-20731 · WordPress · Wp Mobile Menu

Name of the Vulnerable Software and Affected Versions: WP Mobile Menu plugin for WordPress versions up to, and including, 2.8.4.4 Description: The issue allows unauthorized modification of data due to a missing capability check on the save menu item icon function. This makes it possible for...

CVE-2024-6750

The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete pos...