Yet Another Related Posts Plugin

yet_another_related_posts_plugin

Vendor: Yarpp • 7 CVEs

CVEs (7)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-43919 1Yarpp 1Yet Another Related Posts Plugin Jun 17, 2026 Nov 1, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Access Control vulnerability in YARPP YARPP allows . This issue affects YARPP: from n/a through 5.30.10.
CVE-2023-6495 1Yarpp 1Yet Another Related Posts Plugin Jun 17, 2026 Jun 19, 2024 N/A· v4 4.8 MEDIUM· v3 N/A· v2 The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 5.30.9 due to insufficient input sanitization and outp...Show more The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.Show less
CVE-2022-45374 1Yarpp 1Yet Another Related Posts Plugin Jun 17, 2026 May 17, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in YARPP allows PHP Local File Inclusion.This issue affects YARPP: from n/a through 5.30.4.
CVE-2024-0602 1Yarpp 1Yet Another Related Posts Plugin Jun 17, 2026 Feb 29, 2024 N/A· v4 4.0 MEDIUM· v3 N/A· v2 The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.30.9 due to insufficient input sanitization and ou...Show more The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.Show less
CVE-2023-0579 1Yarpp 2Yarpp Yet Another Related Posts Plugin Jun 17, 2026 Aug 16, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL I...Show more The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks.Show less
CVE-2023-2433 1Yarpp 1Yet Another Related Posts Plugin Jun 17, 2026 Jul 18, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it pos...Show more The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2022-4471 1Yarpp 1Yet Another Related Posts Plugin Jun 17, 2026 Feb 13, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor...Show more The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacksShow less