WordPress Related Posts <= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin contains an authenticated admin+ stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser. Put the following payload in the "Related Posts Title" settings of the plugin...

WordPress Related Posts plugin <= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ganesh Bagaria in WordPress Related Posts plugin versions = 3.6.4. Solution Plugin closed. No patched version is available. Deactivate and delete...

Contextual Related Posts < 2.9.4 - CSRF Nonce Validation Bypass

The plugin does not properly check for the CSRF nonce in the export and import features, which could allow attackers to make authenticated logged in administrators perform those actions via a CSRF attack. To bypass the nonce validation, just don't send the crpexportsettingsnonce or...

Contextual Related Posts < 2.9.4 - CSRF Nonce Validation Bypass

The plugin does not properly check for the CSRF nonce in the export and import features, which could allow attackers to make authenticated logged in administrators perform those actions via a CSRF attack. PoC To bypass the nonce validation, just don't send the crpexportsettingsnonce or...

WordPress Contextual Related Posts plugin <= 2.9.3 - Cross-Site Request Forgery (CSRF) Nonce Validation Bypass vulnerability

Cross-Site Request Forgery CSRF Nonce Validation Bypass vulnerability found by Lenon Leite in WordPress Contextual Related Posts plugin versions = 2.9.3. Solution Update the WordPress Contextual Related Posts plugin to the latest available version at least 2.9.3...

WordPress Related Posts Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Related Posts is a plugin for adding related content. WordPress Related Posts plugin version 1.8.2 before the cross-site scripting...

CVE-2015-9361

The Related Posts plugin before 1.8.2 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9361

The CVE-2015-9361 entry concerns the WordPress Related Posts plugin (before 1.8.2). The vulnerability is a cross-site scripting (XSS) flaw triggered via add_query_arg() and remove_query_arg(), allowing injected client-side scripts. Affected component: Related Posts plugin for WordPress; root caus...

WordPress Yuzo Related Posts Plugin Cross-Site Scripting

A Cross-Site Scripting vulnerability exists in WordPress Yuzo Related Posts plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

CVE-2019-11869

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...

CVE-2019-11869

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...

Design/Logic Flaw

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...

CVE-2019-11869

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...

CVE-2019-11869

The CVE-2019-11869 entry concerns the WordPress Yuzo Related Posts plugin before 5.12.94. A cross-site scripting (XSS) flaw arises because the plugin relies on is_admin() to verify the request origin, but that check only confirms the request targets an admin page, not that it comes from an admin ...

VulnCheck KEV: CVE-2019-11869

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin...

Users Urged to Uninstall WordPress Yuzo Plugin After Flaw Exploited

UPDATE Users of the popular Yuzo Related Posts plugin are being urged to uninstall the plugin after a flaw was discovered being exploited in the wild – putting tens of thousands of websites at risk. Yuzo Related Posts, which enables WordPress websites to display “related posts” segments, is...

WordPress Yuzo Related Posts plugin <=5.12.91 - Broken authentication

Broken authentication and session management allows unauthenticated call any action or update any option on WordPress Yuzo Related Posts plugin versions =5.12.91. Solution 10 April 2019 - this plugin was closed and is no longer available for download...

WordPress Relevant Related Posts 1.0.7 Cross Site Scripting Vulnerability

WordPress Relevant Related Posts plugin version 1.0.7 suffers from a cross site scripting vulnerability. WordPress Relevant Related Posts 1.0.7 Cross Site Scripting Plugin Name : Relevant Related Posts Plugin Effected Version : 1.0.7 and most probably lower version's if any Vulnerability :...

WordPress Relevant Related Posts 1.0.7 Cross Site Scripting

Plugin Name : Relevant Related Posts Plugin Effected Version : 1.0.7 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following fields pu...

WordPress plugin Yet Another Related Posts '/wp-admin/options-general.php' cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site.Yet Another Related Posts Plugin for WordPress is a wordpress plugin. The WordPress plugin Yet Another Related Posts...