Threat Entry Updated 2026-06-17

CVE-2026-2986 - Contextual Related Posts Plugin

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Contextual Related Posts

CVE-2026-2986

MEDIUM CVSS 6.4 2026-04-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-03-25

CVE-2023-0252 - Contextual Related Posts Plugin

The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

PLUGIN Contextual Related Posts

CVE-2023-0252

MEDIUM CVSS 5.4 2023-02-06

Risk Score

Open Full Technical Breakdown