CVE

In April 2024, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the popular WordPress plugin Widget for Social Page Feeds (formerly known as “Facebook Page Like Widget”). This plugin is installed on over 80,000 WordPress sites and is widely used to display Facebook page feeds in sidebars and other widget areas. The vulnerability, assigned CVE-2024-13207, affects all plugin versions below 6.4.2 and can allow attackers to inject malicious JavaScript, potentially leading to full site compromise.

In early 2024, a security flaw was identified in the popular WordPress plugin Simple Social Media Share Buttons, used on thousands of websites to enhance social media engagement. The vulnerability, now tracked as CVE-2024-13610, allows attackers to inject persistent JavaScript (Stored XSS) into the admin panel via the YouTube Channel ID field inside the widget settings. In the worst-case scenario, this could lead to the creation of backdoor admin accounts, full site compromise, or even malware distribution to site visitors.

Meta Slider is a widely used WordPress plugin that helps users create image sliders, carousels, and other content displays. With over 600,000 installations, the plugin is a popular choice among developers and website owners for its ease of use and flexibility. However, a serious security flaw—CVE-2025-1203—has been discovered in Meta Slider, which allows malicious users to inject and execute JavaScript through a Stored Cross-Site Scripting (XSS) attack. This vulnerability enables attackers to potentially create backdoors on WordPress sites, leading to full administrative control of the site.

Cross-Site Request Forgery (CSRF) is a type of web security vulnerability that allows an attacker to execute unauthorized actions on behalf of an authenticated user. In the case of the Event Tickets with Ticket Scanner plugin (version <= 2.5.4), a CSRF vulnerability has been discovered, allowing attackers to delete all tickets without proper authorization.

The Weber – Free Sign Up Form and Landing Page Builder plugin for WordPress is designed to facilitate email marketing, lead generation, and newsletter management. It allows users to create and embed sign-up forms, automate email campaigns, and integrate various marketing tools seamlessly. However, a critical security vulnerability, CVE-2024-13313, was identified in versions below 7.3.21, allowing Stored Cross-Site Scripting (XSS) attacks. This article explores the discovery, exploitation, and mitigation of this vulnerability.

Meta Slider is one of the most popular WordPress plugins used to create responsive image sliders. It offers flexibility and customization options to enhance the visual appeal of websites. However, a critical Stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-1062) has been discovered in the plugin. This vulnerability allows attackers with editor privileges to inject malicious JavaScript into the plugin’s slider settings. By exploiting this flaw, an attacker can gain unauthorized access to a WordPress site, potentially compromising it completely. The vulnerability affects versions with over 600k installs, making it a widespread security risk for many WordPress-powered websites.

Pods is a powerful plugin for WordPress that allows users to create and manage custom post types, fields, and taxonomies. This plugin is widely used for extending WordPress’s native functionality and creating custom content types to suit different needs. However, a severe SQL Injection vulnerability (CVE-2025-1446) has been discovered in the Pods plugin. This vulnerability allows an attacker to inject malicious SQL queries via user input, potentially leading to unauthorized access to the WordPress database. If exploited, this flaw could result in data leakage, manipulation, or even full administrative control over the site.

Nested Pages is a popular WordPress plugin designed to help website administrators organize their pages and posts hierarchically. This plugin allows for easy drag-and-drop management of WordPress pages and custom post types, making it a valuable tool for many site

Calculated Fields Form is a WordPress plugin that enables users to create custom forms with calculated fields, ideal for use in forms that require mathematical calculations such as price estimators, financial forms, and surveys. While the plugin offers a lot of flexibility and customization options, it also contains a critical vulnerability (CVE-2024-13382). This vulnerability allows attackers to inject malicious JavaScript into form fields, which can then be executed by users interacting with the form. The result of exploiting this vulnerability is a potential backdoor access, allowing attackers to perform actions such as account takeover and unauthorized administrative control of the website. This issue impacts versions of the plugin with 50k+ installations, posing a serious security risk to many WordPress sites.

The Photo Gallery by 10Web plugin is a widely used WordPress plugin designed to help users create beautiful and organized image galleries on their websites. This plugin allows website owners to display their images in various formats, enhancing the visual appeal of their site. However, a severe vulnerability (CVE-2024-13124) has been discovered in the plugin, which allows an attacker to inject malicious JavaScript into the gallery’s title field. This Stored Cross-Site Scripting (XSS) vulnerability can lead to the execution of arbitrary scripts, enabling attackers to potentially create backdoor admin accounts and gain unauthorized access to the site. With over 200,000 installations, this flaw poses a significant threat to websites relying on this plugin.