CVE-2021-36872: WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-23 · updated 2026-06-17
Weakness: CWE-79

Description

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widget-wpp[2][post_type].

Affected products

Hector Cabrera WordPress Popular Posts: through 5.3.3

References

https://github.com/cabrerahector/wordpress-popular-posts/blob/master/changelog.md
https://patchstack.com/database/vulnerability/wordpress-popular-posts/wordpress-popular-posts-plugin-5-3-3-authenticated-persistent-cross-site-scripting-xss-vulnerability
https://github.com/cabrerahector/wordpress-popular-posts/blob/master/changelog.md
https://patchstack.com/database/vulnerability/wordpress-popular-posts/wordpress-popular-posts-plugin-5-3-3-authenticated-persistent-cross-site-scripting-xss-vulnerability

Get alerted when CVE-2021-36872 or the next vulnerability affects your stack