Hector Cabrera WordPress Popular Posts vulnerabilities

Latest Hector Cabrera WordPress Popular Posts CVEs

Newest publication first

1. CVE-2023-45607 WordPress WordPress Popular Posts Plugin <= 6.3.2 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-10-18

   Medium·CVSS 5.4 EPSS 0.40%

   Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions.

2. CVE-2022-43468 WordPress Popular Posts <= 6.0.5 - Unauthenticated Views Changes

   Published 2022-12-07

   High·CVSS 7.5 EPSS 0.96%

   External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article...

3. CVE-2021-36872 WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

   Published 2021-09-23

   Medium·CVSS 5.4 EPSS 0.59%

   Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widget-wpp[2][post_type].

4. CVE-2021-20746 WordPress Popular Posts <= 5.3.2 - Authenticated Cross-Site Scripting

   Published 2021-06-28

   Medium·CVSS 5.4 EPSS 1.4%

   Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.