Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2023-6495

YARPP – Yet Another Related Posts Plugin <= 5.30.9 - Authenticated(Administrator+) Cross-Site Scripting

The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Yarpp
Products
Yet Another Related Posts Plugin
CVE-2023-2433

YARPP – Yet Another Related Posts Plugin <= 5.30.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Yarpp
Products
Yet Another Related Posts Plugin
CVE-2024-0602

Yet Another Related Posts Plugin (YARPP) <= 5.30.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings

The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Yarpp
Products
Yet Another Related Posts Plugin
CVE-2023-0579

YARPP - Yet Another Related Posts Plugin < 5.30.3 - Subscriber+ SQLi

The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Yarpp
Products
Yet Another Related Posts Plugin
CVE-2022-45374

WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.4 - Local File Inclusion

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in YARPP allows PHP Local File Inclusion.This issue affects YARPP: from n/a through 5.30.4.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Yarpp
Products
Wordpress Yarpp Yet Another Related Posts Plugin
CVE-2022-4471

YARPP - Yet Another Related Posts Plugin < 5.30.3 - Contributor+ Stored XSS

The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Yarpp
Products
Yet Another Related Posts Plugin
CVE-2024-43919

WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 - Broken Access Control vulnerability

Access Control vulnerability in YARPP YARPP allows . This issue affects YARPP: from n/a through 5.30.10.

CVSS 3.1 · 5.3 Medium EPSS 44.9% KEV · Not listed
Vendors
Yarpp
Products
Yarpp Yet Another Related Posts Plugin