CVE-2026-4338

The ActivityPub WordPress plugin (versions before 8.0.2 ) is vulnerable to an unauthenticated drafts/scheduled/pending posts disclosure vulnerability. The root cause is a failure to properly filter posts before they are displayed, which allows unauthenticated users to access internal content such...

CVE-2023-5057

CVE-2023-5057 affects the ActivityPub for WordPress plugin prior to 1.0.0. The vulnerability arises because the plugin does not escape user metadata before outputting it in mentions, enabling Stored XSS by a Contributor+ user. Impact is stored cross-site scripting via mentions in affected WordPre...

CVE-2023-3746

The CVE-2023-3746 refers to the ActivityPub for WordPress plugin (pre-1.0.1) where post content was not properly sanitized/escaped, enabling Stored XSS by contributors and higher. Public details consistently state the vulnerability stems from insufficient sanitization of post content, allowing an...

CVE-2023-3707

CVE-2023-3707 concerns the ActivityPub for WordPress plugin (pre-1.0.0). It allows an authenticated user (e.g., a subscriber) to disclose contents of arbitrary posts (including drafts and private posts) via an IDOR vector, with password‑protected posts unaffected. The issue’s root cause is improp...

CVE-2023-3706

The CVE-2023-3706 entry corresponds to the WordPress ActivityPub plugin (pre-1.0.0). It describes an IDOR flaw where an authenticated user (e.g., a subscriber) can retrieve the title of arbitrary posts, including drafts and private posts, via a post ID because the plugin does not ensure that titl...