devpups social pug vulnerabilities

Latest devpups social pug CVEs

Newest publication first

1. CVE-2024-10145 Hubbub Lite < 1.34.4 - Admin+ Stored XSS

   Published 2025-05-15

   Medium·CVSS 4.8 EPSS 0.33%

   The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite s...

2. CVE-2024-1526 Hubbub Lite < 1.33.1 - Unauthenticated Password Protected Posts Access

   Published 2024-04-01

   Medium·CVSS 5.3 EPSS 0.52%

   The Hubbub Lite WordPress plugin before 1.33.1 does not ensure that user have access to password protected post before displaying its content in a meta tag.

3. CVE-2016-10736 Grow Social <= 1.2.5 - Reflected Cross-Site Scripting

   Published 2019-01-09

   Medium·CVSS 6.1 EPSS 1.1%

   The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.