Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress Contextual Related Posts — verificado contra la base de datos de seguridad local de WP Clinic.
Qué hace este plugin
- Slug:
contextual-related-posts
- 50000+ instalaciones activas
contextual related postsrelatedrelated postsseosimilar posts
Estado de mantenimiento
- Última versión conocida: 4.3.0
- Requiere PHP: 7.4+
- PHP máximo soportado (analizado): 8.4
Vulnerabilidades conocidas
6 CVEs conocidos registrados para Contextual Related Posts.
Reportadas entre 2013 y 2026.
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
CVE-2026-2986
|
Contextual Related Posts [contextual-related-posts] < 4.2.2 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,4
|
< 4.2.2
|
4.2.2 |
2026-04-17 |
✓ corregido en la última versión
|
|
CVE-2026-32565
|
Contextual Related Posts [contextual-related-posts] < 4.2.2 |
Falta de control de autorización |
Media
5,3
|
< 4.2.2
|
4.2.2 |
2026-03-18 |
✓ corregido en la última versión
|
|
CVE-2025-47506
|
Contextual Related Posts [contextual-related-posts] < 4.0.3 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,5
|
< 4.0.3
|
4.0.3 |
2025-05-07 |
✓ corregido en la última versión
|
|
—
|
Contextual Related Posts [contextual-related-posts] < 3.3.2 |
— |
Desconocido
|
< 3.3.2
|
3.3.2 |
2023-02-21 |
✓ corregido en la última versión
|
|
—
|
Contextual Related Posts [contextual-related-posts] < 3.3.2 |
— |
Desconocido
|
< 3.3.2
|
3.3.2 |
2023-02-20 |
✓ corregido en la última versión
|
|
—
|
Contextual Related Posts [contextual-related-posts] < 3.3.2 |
— |
Desconocido
|
< 3.3.2
|
3.3.2 |
2023-02-20 |
✓ corregido en la última versión
|
|
CVE-2023-0252
|
Contextual Related Posts [contextual-related-posts] < 3.3.1 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 3.3.1
|
3.3.1 |
2023-02-06 |
✓ corregido en la última versión
|
|
—
|
Contextual Related Posts [contextual-related-posts] < 3.3.1 |
— |
Desconocido
|
< 3.3.1
|
3.3.1 |
2023-01-06 |
✓ corregido en la última versión
|
CVE-2026-2986
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2026-32565
The Contextual Related Posts plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 4.2.2 (exclusive). This makes it possible for unauthenticated attackers to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-47506
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Contextual Related Posts [contextual-related-posts] < 3.3.2
Update the WordPress Contextual Related Posts plugin to the latest available version (at least 3.3.2).
WordFence discovered and reported this Broken Access Control vulnerability in WordPress Contextual Related Posts Plugin. This vulnerability has been fixed in version 3.3.2.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Contextual Related Posts [contextual-related-posts] < 3.3.2
The Contextual Related Posts plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the crp_ajax_clearcache function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to clear the Contextual Related Posts cache.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Contextual Related Posts [contextual-related-posts] < 3.3.2
The Contextual Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the crpClearCache function triggered via the crp_clear_cache AJAX action. This makes it possible for unauthenticated attackers to clear the Contextual Related Posts cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2023-0252
The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
Contextual Related Posts [contextual-related-posts] < 3.3.1
Update the WordPress Contextual Related Posts plugin to the latest available version (at least 3.3.1).
WordfenceTeam discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Contextual Related Posts Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.3.1.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
+ 6 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
—
|
Contextual Related Posts [contextual-related-posts] < 3.3.1 |
— |
Desconocido
|
< 3.3.1
|
3.3.1 |
2023-01-05 |
✓ corregido en la última versión
|
|
—
|
Contextual Related Posts [contextual-related-posts] < 2.9.4 |
— |
Desconocido
|
< 2.9.4
|
2.9.4 |
2020-11-19 |
✓ corregido en la última versión
|
|
—
|
Contextual Related Posts [contextual-related-posts] < 2.9.4 |
— |
Desconocido
|
< 2.9.4
|
2.9.4 |
2020-11-19 |
✓ corregido en la última versión
|
|
CVE-2014-3937
|
Contextual Related Posts [contextual-related-posts] < 1.8.10.2 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Desconocido
|
< 1.8.10.2
|
1.8.10.2 |
2014-03-06 |
✓ corregido en la última versión
|
|
CVE-2013-2710
|
Contextual Related Posts [contextual-related-posts] < 1.8.7 |
Falsificación de petición en sitios cruzados (CSRF) |
Desconocido
|
< 1.8.7
|
1.8.7 |
2013-03-26 |
✓ corregido en la última versión
|
|
—
|
Contextual Related Posts [contextual-related-posts] < 2.9.4 |
— |
Desconocido
|
< 2.9.4
|
2.9.4 |
— |
✓ corregido en la última versión
|
Contextual Related Posts [contextual-related-posts] < 3.3.1
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Contextual Related Posts [contextual-related-posts] < 2.9.4
Cross-Site Request Forgery (CSRF) Nonce Validation Bypass vulnerability found by Lenon Leite in WordPress Contextual Related Posts plugin (versions <= 2.9.3).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Contextual Related Posts [contextual-related-posts] < 2.9.4
The Contextual Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.3. This is due to missing or incorrect nonce validation on the crp_process_settings_export() or crp_process_settings_import() functions. This makes it possible for unauthenticated attackers to perform administrative actions and/or obtain unauthorized information via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2014-3937
SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2013-2710
Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via unspecified vectors.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
Contextual Related Posts [contextual-related-posts] < 2.9.4
The plugin does not properly check for the CSRF nonce in the export and import features, which could allow attackers to make authenticated logged in administrators perform those actions via a CSRF attack.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Cómo solucionarlo
Mantén Contextual Related Posts actualizado — 4.3.0 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Alternativas más seguras / más establecidas