Wd Facebook Feed Vulnerabilities

The 10Web Social Post Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

up to 1.2.9

Fix:

No patched version reported

Disclosed:

Oct 24, 2024

CVE-2024-9607 on NVD →

The 10Web Social Post Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succe...

CVSS:

6.1

Affected:

up to 1.2.8

Fixed in:

1.2.9

Disclosed:

May 10, 2023

CVE-2023-2503 on NVD →

The 10WebSocial plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to, and including, 1.1.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with adminis...

CVSS:

6.8

Affected:

up to 1.1.27

Fixed in:

1.1.27

Disclosed:

Sep 11, 2020