Intelly Related Posts Vulnerabilities

The Inline Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in p...

CVSS:

6.4

Affected:

up to 3.8.0

Fixed in:

3.9.0

Disclosed:

May 7, 2025

CVE-2025-47604 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Migitation, Inc. Inline Related Posts allows Stored XSS. This issue affects Inline Related Posts: from n/a through 3.8.0.

Affected:

up to 3.8.0

Fix:

No patched version reported

Disclosed:

May 7, 2025

CVE-2025-47604 on NVD →

[en] The Inline Related Posts WordPress plugin before 3.8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 3.8.0

Fixed in:

3.8.0

Disclosed:

Jul 29, 2024

CVE-2024-6487 on NVD →

[en] The Inline Related Posts WordPress plugin before 3.7.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected:

up to 3.7.0

Fixed in:

3.7.0

Disclosed:

Jul 12, 2024

CVE-2024-5626 on NVD →

The Inline Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inj...

CVSS:

4.4

Affected:

up to 3.7.0

Fixed in:

3.8.0

Disclosed:

Jul 8, 2024

CVE-2024-6487 on NVD →

The Inline Related Posts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can suc...

CVSS:

6.1

Affected:

up to 3.6.0

Fixed in:

3.7.0

Disclosed:

Jun 21, 2024

CVE-2024-5626 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Data443 Inline Related Posts.This issue affects Inline Related Posts: from n/a through 3.3.1.

Affected:

up to 3.4.0

Fixed in:

3.4.0

Disclosed:

Apr 15, 2024

CVE-2024-31426 on NVD →

[en] The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayed, allowing any authenticated user, such as subscriber to retrieve the content of password protected posts

Affected:

up to 3.6.0

Fixed in:

3.6.0

Disclosed:

Apr 11, 2024

CVE-2023-6257 on NVD →

The Inline Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the manager_trackingOn() and manager_trackingOff() functions. This makes it possible for unauthenticated attackers to turn tracking o...

CVSS:

4.3

Affected:

up to 3.3.1

Fixed in:

3.4.0

Disclosed:

Apr 10, 2024

CVE-2024-31426 on NVD →

[en] The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected:

up to 3.5.0

Fixed in:

3.5.0

Disclosed:

Apr 6, 2024

CVE-2024-2444 on NVD →

The Inline Related Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.0 via the irp_get_list_posts() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the contents of password protected post...

CVSS:

4.3

Affected:

up to 3.5.0

Fixed in:

3.6.0

Disclosed:

Mar 21, 2024

CVE-2023-6257 on NVD →

The Inline Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inj...

CVSS:

4.4

Affected:

up to 3.4.0

Fixed in:

3.5.0

Disclosed:

Mar 16, 2024

CVE-2024-2444 on NVD →

The Inline Related Posts plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative capabilities, to inject arbitrary web scripts that execute in a...

CVSS:

5.5

Affected:

up to 3.0.4

Fixed in:

3.0.5

Disclosed:

Oct 9, 2021

The Inline Related Posts plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative capabilities, to inject arbitrary web scripts that execute in a...

Affected:

up to 3.0.5

Fixed in:

3.0.5

Disclosed:

Oct 9, 2021

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 3.0.5

Fixed in:

3.0.5

CVE-2021-35470 on NVD →