WordPress Contextual Related Posts plugin <= 4.0.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Contextual Related Posts versions = 4.0.2...

CVE-2025-4171

The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2025-4171 WZ Followed Posts – Display what visitors are reading <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2025-4171 WZ Followed Posts – Display what visitors are reading <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2025-4171

CVE-2025-4171 affects the WordPress plugin WZ Followed Posts – Display what visitors are reading, with Stored XSS via the wfp shortcode in all versions up to 3.1.0. The vulnerability requires authenticated access at the Contributor level or higher and arises from insufficient input sanitization a...

PT-2025-20035 · WordPress · Wz Followed Posts

Name of the Vulnerable Software and Affected Versions: WZ Followed Posts – Display what visitors are reading plugin for WordPress versions up to and including 3.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode due to insufficient input...

PT-2025-20176 · Data443 Risk Mitigation · Inline Related Posts

Name of the Vulnerable Software and Affected Versions: Data443 Risk Migitation, Inc. Inline Related Posts versions n/a through 3.8.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS in...

CVE-2025-4171: Improper Neutralization of Input During Web Page Generation

The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

PT-2025-20136 · Unknown · Eli'S Related Posts Footer Links/Widget

Name of the Vulnerable Software and Affected Versions: ELI's Related Posts Footer Links and Widget versions 1.2.04.20 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended...

PT-2025-20130 · Unknown · Contextual Related Posts

Name of the Vulnerable Software and Affected Versions: Ajay Contextual Related Posts versions n/a through 4.0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an...

CVE-2025-47506: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ajay Contextual Related Posts contextual-related-posts allows DOM-Based XSS.This issue affects Contextual Related Posts: from n/a through = 4.0.2...

CVE-2025-47514: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Eli ELI's Related Posts Footer Links and Widget spostarbust allows Stored XSS.This issue affects ELI's Related Posts Footer Links and Widget: from n/a through = 1.2.04.20...

CVE-2025-47484: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Oliver Campion Display Remote Posts Block display-remote-posts-block allows Server Side Request Forgery.This issue affects Display Remote Posts Block: from n/a through = 1.1.0...

CVE-2025-47636: Path Traversal: '.../...//'

Path Traversal: '.../...//' vulnerability in Fernando Briano List category posts list-category-posts allows PHP Local File Inclusion.This issue affects List category posts: from n/a through = 0.91.0...

CVE-2025-47604: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Data443 Risk Mitigation, Inc. Inline Related Posts intelly-related-posts allows Stored XSS.This issue affects Inline Related Posts: from n/a through = 3.8.0...

CVE-2025-2905

creationtimestamp| type| source ---|---|--- 2025-05-05 09:18:55+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14842 2025-05-05 10:21:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3log5hwunmf2o 2025-05-05 13:01:47+00:00| seen|...

Improper Authorization

github.com/mattermost/mattermost-server is vulnerable to improper authorization. The vulnerability is due to insufficient permission validation for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts created by the Playbooks bot...

CVE-2025-4237

creationtimestamp| type| source ---|---|--- 2025-05-03 15:19:06+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14695 2025-05-03 16:38:46+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lobq6adw53s2 2025-05-03...

CVE-2024-13738

creationtimestamp| type| source ---|---|--- 2025-05-03 03:00:20+00:00| seen| https://bsky.app/profile/potato.software/post/3loadvtqidf2m 2025-05-03 03:26:30+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3loafeewn5vx2 2025-05-03...

CVE-2023-53141

creationtimestamp| type| source ---|---|--- 2025-05-02 17:34:19+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lo7c2mv5kd32 2025-05-02 20:06:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo7mr4dh5p2t 2025-05-02...