Contextual Related Posts Vulnerabilities

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and ab...

CVSS:

6.4

Affected:

up to 4.2.1

Fixed in:

4.2.2

Disclosed:

Apr 17, 2026

CVE-2026-2986 on NVD →

Broken Access Control vulnerability

CVSS:

5.3

Affected:

up to 4.2.2

Fixed in:

4.2.2

Disclosed:

Mar 18, 2026

The Contextual Related Posts plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 4.2.2 (exclusive). This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 4.2.2

Fixed in:

4.2.2

Disclosed:

Mar 18, 2026

CVE-2026-32565 on NVD →

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts...

CVSS:

6.4

Affected:

up to 4.0.2

Fixed in:

4.0.3

Disclosed:

May 7, 2025

CVE-2025-47506 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Contextual Related Posts allows DOM-Based XSS. This issue affects Contextual Related Posts: from n/a through 4.0.2.

Affected:

up to 4.0.3

Fixed in:

4.0.3

Disclosed:

May 7, 2025

CVE-2025-47506 on NVD →

Update the WordPress Contextual Related Posts plugin to the latest available version (at least 3.3.2). WordFence discovered and reported this Broken Access Control vulnerability in WordPress Contextual Related Posts Plugin. This vulnerability has been fixed in version 3.3.2.

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Feb 21, 2023

The Contextual Related Posts plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the crp_ajax_clearcache function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to clear th...

CVSS:

4.3

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Feb 20, 2023

The Contextual Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the crpClearCache function triggered via the crp_clear_cache AJAX action. This makes it possible for unauthenticated attackers to...

CVSS:

4.3

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Feb 20, 2023

The Contextual Related Posts plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the crp_ajax_clearcache function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to clear th...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Feb 20, 2023

The Contextual Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the crpClearCache function triggered via the crp_clear_cache AJAX action. This makes it possible for unauthenticated attackers to...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Feb 20, 2023

[en] The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Feb 6, 2023

CVE-2023-0252 on NVD →

Update the WordPress Contextual Related Posts plugin to the latest available version (at least 3.3.1). WordfenceTeam discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Contextual Related Posts Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, adve...

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Jan 6, 2023

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contrib...

CVSS:

6.4

Affected:

up to 3.3.0

Fixed in:

3.3.1

Disclosed:

Jan 5, 2023

CVE-2023-0252 on NVD →

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contrib...

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Jan 5, 2023

The Contextual Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.3. This is due to missing or incorrect nonce validation on the crp_process_settings_export() or crp_process_settings_import() functions. This makes it possible for unauthenticated attacker...

CVSS:

4.3

Affected:

up to 2.9.3

Fixed in:

2.9.4

Disclosed:

Nov 19, 2020

Cross-Site Request Forgery (CSRF) Nonce Validation Bypass vulnerability found by Lenon Leite in WordPress Contextual Related Posts plugin (versions <= 2.9.3).

Affected:

up to 2.9.4

Fixed in:

2.9.4

Disclosed:

Nov 19, 2020

The Contextual Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.3. This is due to missing or incorrect nonce validation on the crp_process_settings_export() or crp_process_settings_import() functions. This makes it possible for unauthenticated attacker...

Affected:

up to 2.9.4

Fixed in:

2.9.4

Disclosed:

Nov 19, 2020

Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via unspecified vectors.

CVSS:

8.8

Affected:

up to 1.8.6

Fixed in:

1.8.7

Disclosed:

Aug 1, 2014

CVE-2013-2710 on NVD →

[en] SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Affected:

up to 1.8.10.2

Fixed in:

1.8.10.2

Disclosed:

Jun 2, 2014

CVE-2014-3937 on NVD →

[en] Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via unspecified vectors.

Affected:

up to 1.8.7

Fixed in:

1.8.7

Disclosed:

Jun 2, 2014

CVE-2013-2710 on NVD →

SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVSS:

9.8

Affected:

up to 1.8.10.2

Fixed in:

1.8.10.2

Disclosed:

Mar 6, 2014

CVE-2014-3937 on NVD →

The plugin does not properly check for the CSRF nonce in the export and import features, which could allow attackers to make authenticated logged in administrators perform those actions via a CSRF attack.

Affected:

up to 2.9.4

Fixed in:

2.9.4