Vk Filter Search Vulnerabilities

The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.20.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in page...

CVSS:

6.4

Affected:

up to 2.20.3

Fixed in:

2.20.4

Disclosed:

Apr 4, 2025

CVE-2025-32175 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Filter Search allows Stored XSS. This issue affects VK Filter Search: from n/a through 2.14.1.0.

Affected:

up to 2.15.0.3

Fix:

No patched version reported

Disclosed:

Apr 4, 2025

CVE-2025-32175 on NVD →

[en] The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk_filter_search' shortcode in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

Affected:

up to 2.3.2

Fixed in:

2.3.2

Disclosed:

Oct 27, 2023

CVE-2023-5705 on NVD →

The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk_filter_search' shortcode in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVSS:

6.4

Affected:

up to 2.3.1

Fixed in:

2.3.2

Disclosed:

Oct 25, 2023

CVE-2023-5705 on NVD →