8145 matches found
CVE-2026-1003
The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access a...
CVE-2026-0916
The Related Posts by Taxonomy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'relatedpostsbytax' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...
CVE-2026-0916 Related Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode
The Related Posts by Taxonomy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'relatedpostsbytax' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...
CVE-2026-0916
CVE-2026-0916 - WordPress Related Posts by Taxonomy (plugin) The vulnerability is a Stored Cross-Site Scripting (XSS) in the Related Posts by Taxonomy plugin for WordPress, exploitable via the shortcode; it affects all versions up to and including 2.7.6 due to insufficient input sanitization and ...
CVE-2026-0916
The Related Posts by Taxonomy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'relatedpostsbytax' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...
CVE-2026-0916 Related Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode
The Related Posts by Taxonomy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'relatedpostsbytax' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...
CVE-2025-15527
The WP Recipe Maker plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 10.2.2 via the apigetpostsummary function due to insufficient restrictions on which posts can be retrieved. This makes it possible for authenticated attackers, with Contributor-level...
CVE-2025-15527
The WP Recipe Maker plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 10.2.2 via the apigetpostsummary function due to insufficient restrictions on which posts can be retrieved. This makes it possible for authenticated attackers, with Contributor-level...
CVE-2025-15527
CVE-2025-15527 : WP Recipe Maker for WordPress is vulnerable to Information Exposure up to version 10.2.2 via api_get_post_summary, due to insufficient post-retrieval restrictions. Authenticated attackers with Contributor+ access can read data from posts they shouldn’t be able to edit or read, in...
CVE-2025-15527 WP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure
The WP Recipe Maker plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 10.2.2 via the apigetpostsummary function due to insufficient restrictions on which posts can be retrieved. This makes it possible for authenticated attackers, with Contributor-level...
CVE-2025-14234
creationtimestamp| type| source ---|---|--- 2026-01-16 01:03:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcivnzytvd2u 2026-01-16 01:04:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcivpkihph2v 2026-01-16 01:04:41+00:00| seen|...
CVE-2025-14233
creationtimestamp| type| source ---|---|--- 2026-01-16 01:03:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcivntfojp2v 2026-01-16 01:04:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcivpdcupm2u 2026-01-16 01:04:34+00:00| seen|...
CVE-2025-14232
creationtimestamp| type| source ---|---|--- 2026-01-16 01:03:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcivnmbtur2z 2026-01-16 01:03:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcivp3x5gz2z 2026-01-16 02:07:52+00:00| seen|...
CVE-2025-14231
creationtimestamp| type| source ---|---|--- 2026-01-16 01:01:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcivl2dl3t2m 2026-01-16 01:41:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcixsunlnr2m 2026-01-20 21:24:40+00:00| seen|...
WordPress plugin User Submitted Posts cross-site scripting vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...
CVE-2026-1003: Missing Authorization
The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access a...
PT-2026-3217
The WP Recipe Maker plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 10.2.2 via the api get post summary function due to insufficient restrictions on which posts can be retrieved. This makes it possible for authenticated attackers, with Contributor-leve...
CVE-2026-0916: Improper Neutralization of Input During Web Page Generation
The Related Posts by Taxonomy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'relatedpostsbytax' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...
PT-2026-3225
The Related Posts by Taxonomy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'related posts by tax' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...