Skip to content
OpenAdvisories

Vendor

fernandobt

7 known vulnerabilities.

Products

List category posts 6 List categories 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-12434

    List category posts <= 0.95.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'post_status' Shortcode Attribute

    The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.95.0 via the sanitize_status. This makes it possible for authenticated attackers, with contributor-level access and above, to …

    fernandobt List category posts Web / CMS
  • Medium 6.4
    CVE-2026-3005

    List category posts <= 0.94.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode

    The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.94.0 due to insufficient input sanitization and output escaping on user supplied attributes.…

    fernandobt List category posts Web / CMS
  • Medium 6.5
    CVE-2025-10163

    List Category Posts <= 0.91.0 - Authenticated (Contributor+) SQL Injection via Plugin's Shortcode

    The List category posts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘starting_with’ parameter of the catlist shortcode in all versions up to, and including, 0.91.0 due to insufficient escaping on the user supplied parameter and lack…

    fernandobt List category posts Web / CMS
  • Medium 4.3
    CVE-2025-11377

    List category posts <= 0.92.0 - Authenticated (Contributor+) Information Exposure

    The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticat…

    fernandobt List category posts Web / CMS
  • Medium 6.4
    CVE-2024-4356

    List categories <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The List categories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'categories' shortcode in all versions up to, and including, 0.4 due to insufficient input sanitization and output escaping on user supplied attributes. Thi…

    fernandobt List categories Web / CMS
  • Medium 6.4
    CVE-2024-1051

    List category posts <= 0.89.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.6 due to insufficient input sanitization and output escaping on user supplied attributes …

    fernandobt List category posts Web / CMS
  • Medium 6.4
    CVE-2023-6994

    List category posts <= 0.89.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.3 due to insufficient input sanitization and output escaping on user supplied attributes.…

    fernandobt List category posts Web / CMS