Medium · 5.5 CVE-2021-36872 EUVD-2021-23448GHSA-4g64-jfhc-95g2

WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Published Sep 23, 2021 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Hector Cabrera Product: WordPress Popular Posts Category: Web / CMS

Description

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widget-wpp[2][post_type].

Affected products

Vendor	Product	Affected	Fixed
Hector Cabrera	WordPress Popular Posts	5.3.3 – ≤ 5.3.3	—

References

https://github.com/cabrerahector/wordpress-popular-posts/blob/master/changelog.md
https://patchstack.com/database/vulnerability/wordpress-popular-posts/wordpress-popular-posts-plugin-5-3-3-authenticated-persistent-cross-site-scripting-xss-vulnerability