plugin

Broadstreet Vulnerabilities

17 known security issues reported for the Broadstreet WordPress plugin. Most recent disclosed May 20, 2026.

11 medium

Running Broadstreet on your site? Check whether your installed version is affected.

Scan your site free

Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta

medium

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to di...

CVSS:
4.3
Affected:
up to 1.52.2
Fixed in:
1.53.2
Disclosed:
May 20, 2026

CVE-2026-1881 on NVD →

Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation

medium

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the create_advertiser AJAX action in all versions up to, and including, 1.53.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create advertisers.

CVSS:
4.3
Affected:
up to 1.53.1
Fixed in:
1.53.2
Disclosed:
May 12, 2026

CVE-2025-9988 on NVD →

Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure

medium

The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.53.1 via the get_sponsored_meta() AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protected and private busi...

CVSS:
5.3
Affected:
up to 1.53.1
Fixed in:
1.53.2
Disclosed:
May 12, 2026

CVE-2025-9987 on NVD →

Broadstreet <= 1.53.1 - Authenticated (Admin+) Stored Cross-Site Scripting

medium

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.53.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbi...

CVSS:
4.4
Affected:
up to 1.53.1
Fixed in:
1.53.2
Disclosed:
May 12, 2026

CVE-2025-9989 on NVD →

Broadstreet Ads <= 1.52.2 - Missing Authorization

medium

The Broadstreet Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.52.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:
4.3
Affected:
up to 1.52.2
Fixed in:
1.53.2
Disclosed:
Feb 21, 2026

CVE-2026-45210 on NVD →

Broadstreet [broadstreet] <= 1.52.1 (unfixed)

unknown

[en] Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadstreet Ads: from n/a through <= 1.52.1.

Affected:
up to 1.52.1
Fix:
No patched version reported
Disclosed:
Jan 22, 2026

CVE-2025-69311 on NVD →

Broadstreet Ads <= 1.52.1 - Missing Authorization

medium

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.52.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:
4.3
Affected:
up to 1.52.1
Fixed in:
1.52.2
Disclosed:
Jan 19, 2026

CVE-2025-69311 on NVD →

Broadstreet Ads <= 1.51.7 - Reflected Cross-Site Scripting

medium

The Broadstreet plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.51.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfull...

CVSS:
6.1
Affected:
up to 1.51.7
Fixed in:
1.51.8
Disclosed:
May 29, 2025

CVE-2025-4652 on NVD →

Broadstreet <= 1.51.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

medium

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.51.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha...

CVSS:
6.4
Affected:
up to 1.51.2
Fixed in:
1.51.3
Disclosed:
May 16, 2025

CVE-2025-48113 on NVD →

Broadstreet [broadstreet] <= 1.51.8 (unfixed)

unknown

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet allows Stored XSS. This issue affects Broadstreet: from n/a through 1.51.8.

Affected:
up to 1.51.8
Fix:
No patched version reported
Disclosed:
May 16, 2025

CVE-2025-48113 on NVD →

Broadstreet [broadstreet] <= 1.51.5 (unfixed)

unknown

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet allows Stored XSS. This issue affects Broadstreet: from n/a through 1.51.2.

Affected:
up to 1.51.5
Fix:
No patched version reported
Disclosed:
Apr 8, 2025

CVE-2025-32211 on NVD →

Broadstreet <= 1.52.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

medium

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.52.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that...

CVSS:
6.4
Affected:
up to 1.52.1
Fixed in:
1.52.2
Disclosed:
Apr 7, 2025

CVE-2025-32211 on NVD →

Broadstreet <= 1.51.1 - Cross-Site Request Forgery

medium

The Broadstreet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.51.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administ...

CVSS:
4.3
Affected:
up to 1.51.1
Fixed in:
1.52.2
Disclosed:
Apr 4, 2025

CVE-2025-32270 on NVD →

Broadstreet [broadstreet] <= 1.51.1 (unfixed)

unknown

[en] Cross-Site Request Forgery (CSRF) vulnerability in Broadstreet Broadstreet allows Cross Site Request Forgery. This issue affects Broadstreet: from n/a through 1.51.1.

Affected:
up to 1.51.1
Fix:
No patched version reported
Disclosed:
Apr 4, 2025

CVE-2025-32270 on NVD →

Broadstreet [broadstreet] < 1.51.1

unknown

[en] The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘zone’ parameter in all versions up to, and including, 1.50.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject...

Affected:
up to 1.51.1
Fixed in:
1.51.1
Disclosed:
Jan 25, 2025

CVE-2024-11825 on NVD →

Broadstreet <= 1.51.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via zone Parameter

medium

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘zone’ parameter in all versions up to, and including, 1.51.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbit...

CVSS:
6.4
Affected:
up to 1.51.0
Fixed in:
1.51.1
Disclosed:
Jan 24, 2025

CVE-2024-11825 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database