Approved changes feed: RSS · Atom
cpe:2.3:a:webvitaly:page-list:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Webvitaly (75342b14-6ebd-5a6e-bafe-c439e3501176) |
|---|---|
| Product | Page List (52c83630-2dff-5a61-9e30-21c0b7824289) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-9008 |
vulnerable | 2026-06-08 08:08:58.795759 |
Page-list <= 6.2 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributes
MEDIUM (4.3)
The Page-list plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.2. This is due to the pagelist_unqprfx_ext_shortcode() function (the [pagelist_ext] / [pagelistext] shortcode) accepting attacker-controlled post_status, post_type, and show_meta_key attributes and passing them directly into get_pages() and get_post_meta() with no capability check verifying that the rendering user is permitted to read the matched objects. When the current post has no child pages, the shortcode re-issues the query with child_of => 0, broadening it to every page on the site matching the supplied status/type. This makes it possible for authenticated attackers, with contributor-level access and above, to disclose the titles, body content/excerpts, and arbitrary post meta of unrelated private and draft pages by inserting the shortcode into a contributor-authored draft and previewing it.
Published: 2026-06-06T01:26:08.984Z
Updated: 2026-06-06T11:45:22.259Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-58030 |
vulnerable | 2026-06-08 07:35:16.890500 |
WordPress Page-list Plugin <= 5.8 - Cross Site Scripting (XSS) Vulnerability
MEDIUM (6.5)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Page-list page-list allows Stored XSS.This issue affects Page-list: from n/a through <= 5.8.
Published: 2025-09-22T18:23:54.215Z
Updated: 2026-05-12T00:59:42.016Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-47382 |
vulnerable | 2026-06-08 06:48:11.886809 |
WordPress Page-list plugin <= 5.6 - Cross Site Scripting (XSS) vulnerability
MEDIUM (6.5)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Page-list page-list allows Stored XSS.This issue affects Page-list: from n/a through <= 5.6.
Published: 2024-10-05T14:56:16.600Z
Updated: 2026-04-28T16:10:19.973Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.