¿Es seguro Related Posts For Wp?

Qué hace este plugin

• Slug: related-posts-for-wp
• 10000+ instalaciones activas

contextual relationsinline related postsrelatedseo bounce ratesimilar posts

Estado de mantenimiento

• Última versión conocida: 2.3.0
• Requiere PHP: 7.2+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

4 CVEs conocidos registrados para Related Posts For Wp. Reportadas entre 2015 y 2024.

CVE-2024-0592

The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the handle_create_link() function. This makes it possible for unauthenticated attackers to add related posts to other posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This ultimately makes it possible for attackers to view draft and password protected posts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-3506

The Related Posts for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_text’ parameter in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note, this vulnerability was independently found by two researchers.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Related Posts for WordPress [related-posts-for-wp] < 2.1.2

The Related Posts for WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of unsanitized user input when constructing a URL in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is unlikely to work in newer browsers.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2021-24482

The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings, allowing high privilege users (admin) to set XSS payloads in them, leading to Stored Cross-Site Scripting issues.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2021-24180

Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Related Posts for WordPress [related-posts-for-wp] < 1.8.2

Cross-Site Scripting (XSS) vulnerability discovered by Barry Kooij in WordPress Related Posts for WordPress plugin (versions <= 1.8.1). Update the WordPress Related Posts for WordPress plugin to the latest available version (at least 1.8.2).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Related Posts for WordPress [related-posts-for-wp] < 1.8.2

The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, not including, 1.8.2 due to insufficient input sanitization and output escaping. The same vulnerability exists in Related Posts Premium up to, not including, 1.3.4. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Related Posts for WordPress [related-posts-for-wp] < 1.8.2

The Related Posts for WordPress WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Related Posts For Wp actualizado — 2.3.0 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Inline Related Posts — 100000+ instalaciones activas — 86/100 (77) — PHP máx. 8.4
• Internal Linking of Related Contents — 1000+ instalaciones activas — 84/100 (5) — PHP máx. 8.4