CVE-2021-24597

The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues in frontend posts and the plugins settings page depending on the payload used...

CVE-2021-24512

The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting XSS vulnerability in one of the administrative functions for handling deletion of videos...

CVE-2015-9361

The Related Posts plugin before 1.8.2 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2014-3937

SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2017-18888

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts...

CVE-2011-1762

A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publishposts' permission...

CVE-2016-11001

The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field...

CVE-2011-5270

wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publishposts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role...

CVE-2016-11067

An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang...

CVE-2015-10119

A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress. This issue affects the function actionadminnoticesactivation of the file view-all-posts-pages.php. The manipulation leads to cross site scripting. The attack may be initiat...

CVE-2005-1817

Invision Power Board IPB 1.0 through 1.3 allows remote attackers to edit arbitrary forum posts via a direct request to index.php with modified parameters...

CVE-2006-7188

The search function in cgi-lib/user-lib/search.pl in web-app.net WebAPP before 20060909 allows remote attackers to read internal forum posts via certain requests, possibly related to the $info'forum' variable...

CVE-2025-46263

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lloyd Saunders Author Box After Posts author-box-after-posts allows Stored XSS.This issue affects Author Box After Posts: from n/a through = 1.6...

CVE-2025-39374

Cross-Site Request Forgery CSRF vulnerability in aseem1234 Best Posts Summary best-posts-summary allows Stored XSS.This issue affects Best Posts Summary: from n/a through = 1.0...

CVE-2025-39369

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sihibbs Posts for Page posts-for-page allows DOM-Based XSS.This issue affects Posts for Page: from n/a through = 2.1...

CVE-2025-3750

The CVE CVE-2025-3750 affects the WordPress plugin Network Posts Extended (versions up to and including 7.7.1). It describes a Stored Cross-Site Scripting (Stored XSS) via the post_height parameter caused by insufficient input sanitization and output escaping. Exploitation requires authentication...

CVE-2025-37899

creationtimestamp| type| source ---|---|--- 2025-05-21 08:47:52+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17104 2025-05-22 11:21:06+00:00| seen| https://bsky.app/profile/bluesky.awakari.com/post/3lpqyqrgb452s 2025-05-22 11:21:41+00:00| seen|...

WordPress plugin Network Posts Extended 跨站脚本漏洞

WordPress Network Posts Extended is a WordPress plugin that enhances post publishing and management on WordPress websites. A cross-site scripting vulnerability exists in WordPress Network Posts Extended. The vulnerability stems from insufficient input cleanup and escaping of the postheight...

PT-2025-22333 · WordPress · Network Posts Extended

Name of the Vulnerable Software and Affected Versions: The Network Posts Extended plugin for WordPress versions up to, and including, 7.7.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated...

WordPress Network Posts Extended plugin <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via postheight Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Posts Extended versions = 7.7.1...