grandslambert vulnerabilities

Products

• Login Configurator 2
• Better RSS Widget 1
• Custom Page Extensions 1
• Featured Page Widget 1

Latest grandslambert CVEs

Newest publication first

1. CVE-2025-23888 WordPress Custom Page Extensions Plugin <= 0.6 - Cross Site Scripting (XSS) vulnerability

   Published 2025-01-24

   High·CVSS 7.1 EPSS 0.26%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GrandSlambert Custom Page Extensions custom-page-extensions allows Reflected XSS.This issue affects Custom Page Extensions: from n/a through <= 0.6.

2. CVE-2025-22569 WordPress Featured Page Widget Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-01-13

   High·CVSS 7.1 EPSS 0.27%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GrandSlambert Featured Page Widget featured-page-widget allows Reflected XSS.This issue affects Featured Page Widget: from n/a through <= 2.2.

3. CVE-2023-47813 WordPress Better RSS Widget Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-11-22

   Medium·CVSS 5.4 EPSS 0.42%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions.

4. CVE-2023-34175 WordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-08-30

   Medium·CVSS 6.1 EPSS 0.37%

   Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <= 2.1 versions.

5. CVE-2023-34369 WordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-07-25

   Medium·CVSS 4.8 EPSS 0.37%

   Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <= 2.1 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.