CVE-2026-4338
Published Apr 8, 2026The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts
- evidence mentions
- 1
- Buzz score
- 11.9
Vendor/product archive
automattic / activitypub CVEs
Beta · best-effort5 CVEs tagged to automattic / activitypub — 0 Critical, 1 High, 4 Medium, 0 Low, 0 Unrated.
CVE-2023-5057
Published Oct 16, 2023The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to per…
- evidence mentions
- 1
- Buzz score
- 11.9
CVE-2023-3746
Published Oct 16, 2023The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site S…
- evidence mentions
- 1
- Buzz score
- 11.9
CVE-2023-3707
Published Oct 16, 2023The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subs…
- evidence mentions
- 1
- Buzz score
- 11.9
CVE-2023-3706
Published Oct 16, 2023The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscr…
- evidence mentions
- 1
- Buzz score
- 11.9
Showing 1-5 of 5 CVEsPage 1 of 1