PT-2026-116086

WeRSS we-mp-rss through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/feed id endpoint. Attackers can supply a non-built-in ext value and a =expression template whose object-subclass travers...

CVE-2024-9057

The Curator.io: Show all your social media posts in a beautiful feed. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘feedid’ attribute in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-2208

creationtimestamp| type| source ---|---|--- 2025-03-11 20:41:19+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/7226 2025-08-13 13:26:34+00:00| seen| MISP/682bdba3-46b7-4a8f-b7be-c6bf4b4f9868...

CVE-2024-13406

The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feedid' parameter in all versions up to, and including, 3.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

PT-2025-2160

Name of the Vulnerable Software and Affected Versions XML for Google Merchant Center plugin for WordPress versions up to, and including, 3.0.11 Description The issue concerns Reflected Cross-Site Scripting via the feed id parameter due to insufficient input sanitization and output escaping. This...

PT-2024-39393 · WordPress · The Curator.Io

Name of the Vulnerable Software and Affected Versions: The Curator.io: Show all your social media posts in a beautiful feed. plugin for WordPress versions up to, and including, 1.9 Description: The issue is related to Stored Cross-Site Scripting via the feed id attribute due to insufficient input...

CVE-2024-1365

The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the feedid parameter in all versions up to, and including, 4.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

PT-2024-17977

Name of the Vulnerable Software and Affected Versions YML for Yandex Market plugin for WordPress versions up to, and including, 4.2.3 Description The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attacker...

[R1] Tenable Plugin Feed ID #202212081952 Fixes Arbitrary Code Execution Vulnerability

R1 Tenable Plugin Feed ID 202212081952 Fixes Arbitrary Code Execution Vulnerability Arnie Cabral Fri, 03/10/2023 - 16:28 Audit files that are built into the Tenable products provide capability to adjust the audit evaluation to meet organizational requirements. A vulnerability was reported where...

CVE-2023-25157

creationtimestamp| type| source ---|---|--- 2023-02-22 00:47:08+00:00| seen| https://t.me/cibsecurity/58649 2023-06-06 14:16:00+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4498 2023-06-07 15:39:22+00:00| published-proof-of-concept| https://t.me/dilagrafie/3079 2023-06-08...

PT-2022-9624

Name of the Vulnerable Software and Affected Versions Sync WooCommerce Product feed to Google Shopping WordPress plugin versions 1.2.4 and earlier Description The issue concerns a SQL injection vulnerability in the admin dashboard. It arises from the improper sanitization of the feed id POST...

CVE-2021-24508

The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feedlocator AJAX action available to both authenticated and unauthenticated users before outputting a truncated version of it in the admin dashboard, leading to an...

CVE-2008-4623

SQL injection vulnerability in the DS-Syndicate comds-syndicate component 1.1.1 for Joomla allows remote attackers to execute arbitrary SQL commands via the feedid parameter to index2.php...