https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T01:10:10.476347+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-24958 CVE-2021-24958 — Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS 2026-10-06T01:10:10.491404+00:00

Affected: Unknown Meks Easy Photo Feed Widget

The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the meks_save_business_selected_account AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could update the plugin's settings and put Cross-Site Scripting payloads in them