Magical Posts Display Vulnerabilities

[en] The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpac_title_tag' parameter in the Magical Posts Accordion widget in all versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it...

Affected:

up to 1.2.55

Fixed in:

1.2.55

Disclosed:

Dec 12, 2025

CVE-2025-12965 on NVD →

The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpac_title_tag' parameter in the Magical Posts Accordion widget in all versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it poss...

CVSS:

6.4

Affected:

up to 1.2.54

Fixed in:

1.2.55

Disclosed:

Dec 11, 2025

CVE-2025-12965 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Posts Display allows DOM-Based XSS. This issue affects Magical Posts Display: from n/a through 1.2.52.

Affected:

up to 1.2.53

Fixed in:

1.2.53

Disclosed:

Aug 14, 2025

CVE-2025-54706 on NVD →

The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in...

CVSS:

6.4

Affected:

up to 1.2.52

Fixed in:

1.2.53

Disclosed:

Jul 30, 2025

CVE-2025-54706 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Noor alam Magical Posts Display – Elementor & Gutenberg Posts Blocks allows Stored XSS.This issue affects Magical Posts Display – Elementor & Gutenberg Posts Blocks: from n/a through 1.2.38.

Affected:

up to 1.2.39

Fixed in:

1.2.39

Disclosed:

Jul 20, 2024

CVE-2024-37951 on NVD →

The Magical Posts Display – Elementor & Gutenberg Posts Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and abov...

CVSS:

6.4

Affected:

up to 1.2.38

Fixed in:

1.2.39

Disclosed:

Jul 10, 2024

CVE-2024-37951 on NVD →

The Appsero analytics tool used in several plugins is vulnerable to authorization bypass due to a missing capability check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level permissio...

CVSS:

4.3

Affected:

up to 1.2.15

Fixed in:

1.2.16

Disclosed:

Dec 16, 2022

The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function inten...

CVSS:

4.3

Affected:

up to 1.2.15

Fixed in:

1.2.16

Disclosed:

Dec 14, 2022

CVE-2022-47150 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 1.2.16

Fixed in:

1.2.16

CVE-2022-47150 on NVD →