saas.group vulnerabilities

Products

• Juicer 2

Latest saas.group CVEs

Newest publication first

1. CVE-2026-53737 Juicer through 1.12.18 Stored Cross-Site Scripting via Unescaped API Response

   Published 2026-06-10

   Medium·CVSS 5.3 EPSS 0.16%

   Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected feed data can inject script that executes in an administrator's browser when the settings page loads.

2. CVE-2023-0172 Juicer < 1.11 - Contributor+ Stored XSS

   Published 2023-03-13

   Medium·CVSS 5.4 EPSS 0.47%

   The Juicer WordPress plugin before 1.11 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.