W4 Post List Project

w4_post_list_project

4 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-27413 1W4 Post List Project 1W4 Post List Jun 17, 2026 Jun 22, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Shazzad Hossain Khan W4 Post List plugin <= 2.4.4 versions.
CVE-2023-1373 1W4 Post List Project 1W4 Post List Jun 17, 2026 Apr 17, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The W4 Post List WordPress plugin before 2.4.6 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
CVE-2023-1371 1W4 Post List Project 1W4 Post List Jun 17, 2026 Apr 17, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow any authenticated users to access them
CVE-2023-0374 1W4 Post List Project 1W4 Post List Jun 17, 2026 Apr 17, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role...Show more The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.Show less