Wp Latest Posts Vulnerabilities

The WP Latest Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted image src attributes in post content in versions up to, and including, 5.0.11. This is due to insufficient output escaping in the field() and loop() functions, which extract the raw src attribute value from <img> tags with...

CVSS:

6.4

Affected:

up to 5.0.11

Fix:

No patched version reported

Disclosed:

Jun 23, 2026

CVE-2026-9620 on NVD →

The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the plugin allowing users to execute an action that does not properly validate a user-supplied value prior to using that value in a call to do_shortcode. This makes it poss...

CVSS:

5.4

Affected:

up to 5.0.7

Fixed in:

5.0.8

Disclosed:

May 7, 2024

CVE-2024-4135 on NVD →

The WP Latest Posts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.7.4 due to insufficient input sanitization and output escaping on the 'id' parameter. This makes it possible for unauthorized attackers to inject arbitrary web scripts that execute in a victim's...

CVSS:

6.1

Affected:

up to 3.7.4

Fixed in:

3.7.5

Disclosed:

Aug 15, 2015

CVE-2016-10913 on NVD →