WordPress Plugin "WordPress Popular Posts" accepts untrusted external inputs to update certain internal variables

Overview WordPress Plugin "WordPress Popular Posts" provided by Hector Cabrera accepts untrusted external inputs to update certain internal variables CWE-454. Tsubasa Iinuma of Origami Systems reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

WordPress Plugin: Popular Posts Security Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Popular Posts < 6.1.0 - Unauthenticated Views Manipulation

The plugin does not validate some user inputs via a REST endpoint, which could allow unauthenticated users to update the number of views of articles...

JVN#13927745: WordPress Plugin "WordPress Popular Posts" accepts untrusted external inputs to update certain internal variables

WordPress Plugin "WordPress Popular Posts" provided by Hector Cabrera accepts untrusted external inputs to update certain internal variables CWE-454. Impact The number of views for an article may be manipulated through a crafted input. Solution Update the plugin Update the plugin according to the...

CVE-2022-40205

Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved...

PT-2022-25282 · WordPress · Wpforo Forum

Name of the Vulnerable Software and Affected Versions: wpForo Forum plugin versions = 2.0.5 Description: The issue is related to an insecure direct object references IDOR vulnerability. This vulnerability allows attackers with subscriber or higher user roles to mark any forum post as solved or...

WordPress plugin wpForo Forum has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Easy Digital Downloads vulnerable to cross-site request forgeing attacks

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site request forgery vulnerability exists in the...

CVE-2022-41358

creationtimestamp| type| source ---|---|--- 2022-10-20 07:20:47+00:00| seen| https://t.me/cibsecurity/51861 2025-04-16 09:30:48+00:00| seen| https://bsky.app/profile/nimblenerd.social/post/3lmwbsfcyw52s 2025-04-17 21:02:29+00:00| seen|...

CVE-2022-3506

Cross-site Scripting XSS - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3...

CVE-2022-3506 Cross-site Scripting (XSS) - Stored in barrykooij/related-posts-for-wp

Cross-site Scripting XSS - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3...

CVE-2022-3506 Cross-site Scripting (XSS) - Stored in barrykooij/related-posts-for-wp

Cross-site Scripting XSS - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3...

PT-2022-22540 · WordPress · Related-Posts-For-Wp

Name of the Vulnerable Software and Affected Versions: related-posts-for-wp versions prior to 2.1.3 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository barrykooij/related-posts-for-wp. Recommendations: For versions prior to 2.1.3, update to...

CVE-2022-3506 Cross-site Scripting (XSS) - Stored in barrykooij/related-posts-for-wp

Cross-site Scripting XSS - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3...

CVE-2022-3506

Cross-site Scripting XSS - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3...

CVE-2022-3506: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3...

CVE-2022-3506

CVE-2022-3506 corresponds to a stored XSS vulnerability in the WordPress Related Posts plugin (rp4wp) prior to version 2.1.3. Multiple connected sources confirm the flaw in the rp4wp[heading_text] parameter where unsanitized user input can inject arbitrary script, potentially compromising cookies...

PT-2022-21380 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 7.1.x and earlier Description: The issue arises when a specifically crafted GIF file is uploaded while drafting a post, allowing authenticated users to cause resource exhaustion during file processing. This results in a...

WS-2022-0343

A Reflected Cross-Site-Scripting XSS vulnerability was found in barrykooij/related-posts-for-wp prior to 2.1.2. The rp4wpparent value is echoed without encoding...

Cotonti Siena cross-site scripting vulnerabilities

Cotonti Siena is a powerful open source web development framework and content manager from Cotonti Open Source. A security vulnerability exists in Cotonti Siena version 0.9.20, which originates from allowing administrators to conduct stored XSS attacks via forum posts...