Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: wpxpo Component: Postx Clear all filters
TI-2024-09942 CVE-2024-10728 · GHSA-h7j2-r3qv-9q3v

PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation

Priority HIGH 67

The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the 'install_required_plugin_callbac…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.39069 Published 2024-11-16 No fix listed CWE-862
TI-2024-33876 CVE-2024-50443 · GHSA-gpg3-4r6p-g5p6

WordPress PostX plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through <= 4.1.12.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00277 Published 2024-10-28 No fix listed CWE-79
TI-2024-04008 CVE-2024-4305 · GHSA-97gr-9g44-39q4

PostX < 4.1.0 - Contributor+ Stored XSS

Priority MEDIUM 63

The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which cou…

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.0043 Published 2024-06-17 Fixed in 4.1.0 CWE-79
TI-2024-20622 CVE-2024-31246 · GHSA-m3q5-fm3c-867h

WordPress PostX plugin <= 3.2.3 - Author+ Post/Page Duplication vulnerability

Priority LOW 38

Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 3.2.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00336 Published 2024-06-09 No fix listed CWE-862
TI-2024-03037 CVE-2024-3239 · GHSA-928w-mwq7-xvqr

PostX < 4.0.2 - Contributor+ Stored XSS

Priority LOW 25

The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which cou…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00416 Published 2024-05-13 Fixed in 4.0.2 CWE-79
TI-2023-03707 CVE-2023-3992 · GHSA-xpfj-gvqx-gmx2

PostX - Gutenberg Post Grid Blocks < 3.0.6 - Reflected Cross-Site Scripting

Priority MEDIUM 60

The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00493 Published 2023-08-30 Fixed in 3.0.6