Threat Entry Updated 2026-06-17

CVE-2026-53737 - Juicer Plugin

Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected feed data can inject script that executes in an administrator's browser when the settings page loads.

PLUGIN Juicer

CVE-2026-53737

MEDIUM CVSS 5.3 2026-06-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-27

CVE-2023-0172 - Juicer Plugin

The Juicer WordPress plugin before 1.11 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

PLUGIN Juicer

CVE-2023-0172

MEDIUM CVSS 5.4 2023-03-13

Risk Score

Open Full Technical Breakdown