CVE-2025-47506

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ajay Contextual Related Posts contextual-related-posts allows DOM-Based XSS.This issue affects Contextual Related Posts: from n/a through = 4.0.2...

CVE-2025-47484

Server-Side Request Forgery SSRF vulnerability in Oliver Campion Display Remote Posts Block display-remote-posts-block allows Server Side Request Forgery.This issue affects Display Remote Posts Block: from n/a through = 1.1.0...

CVE-2025-47636

CVE-2025-47636 describes a Path Traversal vulnerability in the WordPress plugin “List category posts” (component: list-category-posts) allowing PHP Local File Inclusion. Public documentation indicates the issue affects versions up to 0.91.0 (and possibly 0.90.x family as per PT-2025-20199), with ...

CVE-2025-47604

CVE-2025-47604 concerns a Stored XSS vulnerability in the WordPress plugin Inline Related Posts by Data443 Risk Mitigation, Inc. The issue stems from improper neutralization of input during web page generation, affecting Inline Related Posts versions up to 3.8.0 . Public documents describe the vu...

CVE-2025-47604 WordPress Inline Related Posts plugin <= 3.8.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Data443 Risk Mitigation, Inc. Inline Related Posts intelly-related-posts allows Stored XSS.This issue affects Inline Related Posts: from n/a through = 3.8.0...

CVE-2025-47604 WordPress Inline Related Posts <= 3.8.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Data443 Risk Migitation, Inc. Inline Related Posts allows Stored XSS. This issue affects Inline Related Posts: from n/a through 3.8.0...

CVE-2025-47514 WordPress ELI's Related Posts Footer Links and Widget plugin <= 1.2.04.20 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Eli ELI's Related Posts Footer Links and Widget spostarbust allows Stored XSS.This issue affects ELI's Related Posts Footer Links and Widget: from n/a through = 1.2.04.20...

CVE-2025-47514

CVE-2025-47514 affects the EZ Related Posts Footer Links and Widget WordPress plugin (versions

CVE-2025-47506 WordPress Contextual Related Posts <= 4.0.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ajay Contextual Related Posts allows DOM-Based XSS. This issue affects Contextual Related Posts: from n/a through 4.0.2...

CVE-2025-47506 WordPress Contextual Related Posts plugin <= 4.0.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ajay Contextual Related Posts contextual-related-posts allows DOM-Based XSS.This issue affects Contextual Related Posts: from n/a through = 4.0.2...

CVE-2025-47506

CVE-2025-47506 (WordPress Contextual Related Posts) is a DOM-based XSS caused by improper input neutralization during page generation, affecting Contextual Related Posts versions n/a–4.0.2. It is not an active exploit entry in public docs; a patch exists and upgrading to a version newer than 4.0....

CVE-2025-47484

CVE-2025-47484 describes a Server-Side Request Forgery (SSRF) vulnerability in the WordPress plugin Display Remote Posts Block, affecting versions up to 1.1.0. The vulnerability is confirmed by multiple sources (Wordfence, Patchstack) and is listed as patched, though no fixed version is specified...

CVE-2025-47484 WordPress Display Remote Posts Block <= 1.1.0 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Oliver Campion Display Remote Posts Block allows Server Side Request Forgery. This issue affects Display Remote Posts Block: from n/a through 1.1.0...

CVE-2025-47484 WordPress Display Remote Posts Block plugin <= 1.1.0 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Oliver Campion Display Remote Posts Block display-remote-posts-block allows Server Side Request Forgery.This issue affects Display Remote Posts Block: from n/a through = 1.1.0...

CVE-2025-2778

creationtimestamp| type| source ---|---|--- 2025-05-07 14:15:11+00:00| seen| https://infosec.exchange/users/shadowserver/statuses/114466967388160257 2025-05-07 14:16:50+00:00| seen| https://bsky.app/profile/shadowserver.bsky.social/post/3lolll3ln2k2p 2025-05-07 14:16:52+00:00| seen|...

WordPress Contextual Related Posts plugin <= 4.0.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Contextual Related Posts versions = 4.0.2...

CVE-2025-4171

The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2025-4171 WZ Followed Posts – Display what visitors are reading <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2025-4171

CVE-2025-4171 affects the WordPress plugin WZ Followed Posts – Display what visitors are reading, with Stored XSS via the wfp shortcode in all versions up to 3.1.0. The vulnerability requires authenticated access at the Contributor level or higher and arises from insufficient input sanitization a...

CVE-2025-4171 WZ Followed Posts – Display what visitors are reading <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...