Vulnerability database

8 results

• Jun 18, 2025tarteaucitron.io: Uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctlyCVE-2025-4955 · WordPress plugins & themes · reported by WPScanMedium 4.7

  The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could allow users with the contributor role and above to perform Stored Cross-site Scripting attacks.

  Product

  tarteaucitron.io

  Fixed in

  1.9.5

  What to do

  Update tarteaucitron.io to 1.9.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Dec 14, 2024glomex oEmbed: Stored Cross-Site ScriptingCVE-2024-11873 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The glomex oEmbed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'glomex_integration' shortcode in all versions up to, and including, 0.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  glomex oEmbed

  Affected

  up to 0.9.1

  What to do

  Affects up to 0.9.1. Update glomex oEmbed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 29, 2024PB oEmbed HTML5 Audio – with Cache Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25098 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Bajorat PB oEmbed HTML5 Audio – with Cache Support allows Stored XSS.This issue affects PB oEmbed HTML5 Audio – with Cache Support: from n/a through 2.6.

  Product

  PB oEmbed HTML5 Audio – with Cache Support

  Affected

  up to 2.6

  What to do

  Affects up to 2.6. Update PB oEmbed HTML5 Audio – with Cache Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Feb 1, 2024oEmbed Gist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52194 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takayuki Miyauchi oEmbed Gist allows Stored XSS.This issue affects oEmbed Gist: from n/a through 4.9.1.

  Product

  oEmbed Gist

  Affected

  up to 4.9.1

  What to do

  Affects up to 4.9.1. Update oEmbed Gist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• May 22, 2019WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/eCVE-2017-6514 · WordPress plugins & themes · reported by MITREMedium 5.3

  WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordsecurityfocus.comgithub.com

• Sep 23, 2017Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.CVE-2017-14724 · WordPress plugins & themes · reported by MITREMedium 6.1

  Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

• Jun 29, 2016The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.CVE-2016-5836 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5

  The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.

  Fixed in

  4.5.3

  What to do

  Update the plugin to 4.5.3 or newer.

  Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

• Jul 8, 2013WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunctCVE-2013-2202 · WordPress plugins & themes · reported by Red HatMedium 4.3

  WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

  Fixed in

  3.5.2

  What to do

  Update the plugin to 3.5.2 or newer.

  Full record and what to do →NVD recordcodex.wordpress.orgwordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.