CVE-2023-1979

CVE-2023-1979 affects the Web Stories for WordPress plugin. The issue allows users with the WordPress Author role to bypass password-protection permission checks when duplicating password-protected stories in the plugin’s dashboard, exposing protected content. The vulnerability was fixed by upgra...

CVE-2022-3708

CVE-2022-3708 affects the WordPress Web Stories plugin prior to version 1.25.0, with SSRF arising from inadequate validation of the url parameter in the /v1/hotlink/proxy REST API. The vulnerability allows authenticated users to cause the web application to perform requests to arbitrary external/...