List Category Posts Vulnerabilities

The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.95.0 via the sanitize_status. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles, full content, excerpts, dates, authors, and c...

CVSS:

4.3

Affected:

up to 0.95.0

Fixed in:

0.96.0

Disclosed:

Jul 15, 2026

CVE-2026-12434 on NVD →

The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.94.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with con...

CVSS:

6.4

Affected:

up to 0.94.0

Fixed in:

0.95.0

Disclosed:

Apr 8, 2026

CVE-2026-3005 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fernando Briano List category posts list-category-posts allows DOM-Based XSS.This issue affects List category posts: from n/a through <= 0.93.1.

Affected:

up to 0.93.1

Fix:

No patched version reported

Disclosed:

Mar 13, 2026

CVE-2026-32419 on NVD →

The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 0.93.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 0.93.1

Fixed in:

0.94.0

Disclosed:

Feb 26, 2026

CVE-2026-32419 on NVD →

[en] The List category posts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘starting_with’ parameter of the catlist shortcode in all versions up to, and including, 0.91.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. T...

Affected:

up to 0.92.0

Fixed in:

0.92.0

Disclosed:

Dec 11, 2025

CVE-2025-10163 on NVD →

The List category posts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘starting_with’ parameter of the catlist shortcode in all versions up to, and including, 0.91.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This m...

CVSS:

6.5

Affected:

up to 0.91.0

Fixed in:

0.92.0

Disclosed:

Dec 10, 2025

CVE-2025-10163 on NVD →

[en] The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, t...

Affected:

up to 0.93.0

Fixed in:

0.93.0

Disclosed:

Nov 1, 2025

CVE-2025-11377 on NVD →

The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to ext...

CVSS:

4.3

Affected:

up to 0.92.0

Fixed in:

0.93.0

Disclosed:

Oct 31, 2025

CVE-2025-11377 on NVD →

The List category posts plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 0.90.3. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those...

CVSS:

7.5

Affected:

up to 0.91.0

Fixed in:

0.92.0

Disclosed:

May 7, 2025

CVE-2025-47636 on NVD →

[en] Path Traversal vulnerability in Fernando Briano List category posts list-category-posts allows PHP Local File Inclusion.This issue affects List category posts: from n/a through 0.91.0.

Affected:

up to 0.90.3

Fix:

No patched version reported

Disclosed:

May 7, 2025

CVE-2025-47636 on NVD →

The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 0.90.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pa...

CVSS:

6.4

Affected:

up to 0.90.2

Fixed in:

0.90.3

Disclosed:

Dec 27, 2024

CVE-2024-9020 on NVD →

[en] The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'title_tag'. This makes it possible for authenticat...

Affected:

up to 0.89.7

Fixed in:

0.89.7

Disclosed:

Mar 30, 2024

CVE-2024-1051 on NVD →

The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'title_tag'. This makes it possible for authenticated at...

CVSS:

6.4

Affected:

up to 0.89.6

Fixed in:

0.89.7

Disclosed:

Mar 29, 2024

CVE-2024-1051 on NVD →

[en] The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

Affected:

up to 0.89.4

Fixed in:

0.89.4

Disclosed:

Jan 11, 2024

CVE-2023-6994 on NVD →

The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with cont...

CVSS:

6.4

Affected:

up to 0.89.3

Fixed in:

0.89.4

Disclosed:

Jan 9, 2024

CVE-2023-6994 on NVD →

Affected:

up to 0.90.3

Fixed in:

0.90.3

CVE-2024-9020 on NVD →