GCVE - cpe:2.3:a:unknown:activitypub:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:activitypub:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Activitypub (`39db3241-a8cd-5724-b644-da9023a16e20`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-4338`	vulnerable	2026-06-08 08:05:13.251044	ActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts Published: 2026-04-08T06:00:08.001Z Updated: 2026-04-08T16:06:53.365Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/50f68395-72fc-4f99-8e6d-6aa90cc640b5/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-5057`	vulnerable	2026-06-08 06:19:41.327877	ActivityPub for WordPress < 1.0.0 - Contributor+ Stored XSS The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks Published: 2023-10-16T19:39:13.142Z Updated: 2024-08-02T07:44:53.809Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/58a63507-f0fd-46f1-a80c-6b1c41dddcf5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-3746`	vulnerable	2026-06-08 06:09:40.410687	ActivityPub for WordPress < 1.0.1 - Contributor+ Stored XSS The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks Published: 2023-10-16T19:39:14.930Z Updated: 2025-04-23T16:12:00.785Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/c15a6032-6495-47a8-828c-37e55ed9665a	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-3707`	vulnerable	2026-06-08 06:09:40.272251	ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Content Disclosure The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as draft and private) via an IDOR vector. Password protected posts are not affected by this issue. Published: 2023-10-16T19:39:12.296Z Updated: 2025-04-23T16:12:12.691Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/541bbe4c-3295-4073-901d-763556269f48	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-3706`	vulnerable	2026-06-08 06:09:40.270846	ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector Published: 2023-10-16T19:39:15.786Z Updated: 2025-04-23T16:11:55.074Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/daa4d93a-f8b1-4809-a18e-8ab63a05de5a	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.