Vulnerabilities

TI-2026-01549 CVE-2026-1881 · GHSA-2rfp-x828-47hv

Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta

LOW 19

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX action due to missing validation on a user controlled ke…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00219 Published 2026-05-21 No fix listed CWE-639

TI-2025-09169 CVE-2025-9989 · GHSA-7c33-q787-xg22

Broadstreet <= 1.53.1 - Authenticated (Admin+) Stored Cross-Site Scripting

LOW 20

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.53.1 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.0019 Published 2026-05-13 No fix listed CWE-79

TI-2025-09167 CVE-2025-9987 · GHSA-386v-44mw-jh76

Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure

LOW 30

The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.53.1 via the get_sponsored_meta() AJAX action.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0027 Published 2026-05-13 No fix listed CWE-200

TI-2025-09168 CVE-2025-9988 · GHSA-f9x9-222c-jq3h

Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation

LOW 19

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the create_advertiser AJAX action in all versions up to, and including, 1.53.1.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00158 Published 2026-05-13 No fix listed CWE-285

TI-2025-04151 CVE-2025-4652 · GHSA-w6rq-5ggq-m372

Broadstreet < 1.51.8 - Reflected XSS

MEDIUM 60

The Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0052 Published 2025-06-09 Fixed in 1.51.8 CWE-79

TI-2024-10969 CVE-2024-11825 · GHSA-8cc6-h3j2-fgx9

Broadstreet <= 1.51.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via zone Parameter

LOW 28

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘zone’ parameter in all versions up to, and including, 1.51.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00326 Published 2025-01-25 No fix listed CWE-79