CVE-2024-2444

The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVE-2023-6257

The Inline Related Posts WordPress plugin, in versions prior to 3.6.0 , is vulnerable to Broken Access Control (OWASP Top 10 A1). The root cause is missing authorization in an AJAX action , which allows any authenticated user, such as a subscriber , to retrieve the content of password-protected p...

CVE-2024-6487

The Inline Related Posts WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 3.8.0 . The root cause is the failure to sanitize and escape certain plugin settings, which allows high-privilege users, such as administrators, to perform XSS attacks. This vulnerabi...

CVE-2024-5626

CVE-2024-5626 affects the Inline Related Posts WordPress plugin prior to version 3.7.0. The issue is that a parameter is not properly sanitized/escaped before being output, causing a Reflected XSS that could target high-privilege users (e.g., admins). The recommended fix is to upgrade to version ...