Yet Another Related Posts Plugin
Approved changes feed: RSS · Atom
cpe:2.3:a:yarpp:yet_another_related_posts_plugin:*:*:*:*:*:wordpress:*:*part: a version: * update: *
| Vendor | Yarpp (3acb5890-3cb1-5cfb-a1b6-b39f7c271cb9) |
|---|---|
| Product | Yet Another Related Posts Plugin (cdd523cf-2926-5feb-aea0-c77cfd0237d6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-43919 |
vulnerable | 2026-06-08 06:45:53.220086 |
WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 - Broken Access Control vulnerability
MEDIUM (5.3)
Access Control vulnerability in YARPP YARPP allows .
This issue affects YARPP: from n/a through 5.30.10.
Published: 2024-11-01T14:17:21.831Z
Updated: 2026-04-28T16:10:13.624Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0602 |
vulnerable | 2026-06-08 06:22:01.463245 |
Yet Another Related Posts Plugin (YARPP) <= 5.30.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings
MEDIUM (4.4)
The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Published: 2024-02-20T18:56:19.507Z
Updated: 2026-04-08T16:36:05.091Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6495 |
vulnerable | 2026-06-08 06:19:47.482862 |
YARPP – Yet Another Related Posts Plugin <= 5.30.9 - Authenticated(Administrator+) Cross-Site Scripting
MEDIUM (4.4)
The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Published: 2024-06-19T08:33:57.218Z
Updated: 2026-04-08T17:26:09.739Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2433 |
vulnerable | 2026-06-08 06:02:42.300195 |
YARPP – Yet Another Related Posts Plugin <= 5.30.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
MEDIUM (6.4)
The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2023-07-18T08:37:09.177Z
Updated: 2026-04-08T16:46:02.192Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0579 |
vulnerable | 2026-06-08 05:52:31.959965 |
YARPP - Yet Another Related Posts Plugin < 5.30.3 - Subscriber+ SQLi
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks.
Published: 2023-08-16T11:03:21.175Z
Updated: 2024-10-08T19:23:55.087Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4471 |
vulnerable | 2026-06-08 05:51:59.552663 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-45374 |
vulnerable | 2026-06-08 05:50:36.143577 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.