4 matches found
CVE-2023-0374
CVE-2023-0374 affects the W4 Post List WordPress plugin prior to version 2.4.6. The vulnerability arises from insufficient validation/escaping of block options before output in a page/post where the block is embedded, enabling Stored XSS by users with Contributor+ privileges. Public details from ...
CVE-2023-1373
The CVE-2023-1373 entry concerns the WordPress plugin W4 Post List, affected up to version 2.4.6. The root cause is insufficient escaping of URLs output in HTML attributes, leading to a reflected XSS vulnerability. Impact is described as Reflected Cross-Site Scripting with low confidentiality/int...
CVE-2023-1371
CVE-2023-1371 affects the W4 Post List WordPress plugin prior to version 2.4.6. The vulnerability arises because the plugin does not properly enforce access controls for password-protected posts before displaying their content, potentially allowing any authenticated user (Subscriber level) to vie...