Makestories Helper Vulnerabilities

The MakeStories (for Google Web Stories) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.4. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application...

CVSS:

6.4

Affected:

up to 3.0.4

Fix:

No patched version reported

Disclosed:

Sep 22, 2025

CVE-2025-57984 on NVD →

The MakeStories (for Google Web Stories) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ms_image_proxy() function in all versions up to, and including, 3.0.3. This makes it possible for unauthenticated attackers to download arbitrary files and perform server-s...

CVSS:

4.3

Affected:

up to 3.0.3

Fixed in:

3.0.4

Disclosed:

Jul 11, 2024

CVE-2024-38746 on NVD →

The MakeStories (for Google Web Stories) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.2. This is due to missing or incorrect nonce validation on the 'ms_set_options' function. This makes it possible for unauthenticated attackers to change the plugin's settings...

CVSS:

4.3

Affected:

up to 3.0.2

Fixed in:

3.0.3

Disclosed:

Aug 28, 2023

CVE-2023-27448 on NVD →

The MakeStories (for Web Stories) plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

Affected:

up to 2.6.4

Fixed in:

2.6.5

Disclosed:

Jul 6, 2022