CVE-2026-121724

MediumCVSS 4.3

Published: 07/11/2026(UTC)Updated: 07/11/2026(UTC)Translated: 07/11/2026(UTC)NVD NIST

Summary

The Contextual Related Posts plugin through version 4.5.3 contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 4.5.3.

Risk Assessment

An unauthorized user may perform actions requiring higher privileges. This could result in unauthorized changes to the plugin or site configuration.

Recommendation

Update the Contextual Related Posts plugin to a version later than 4.5.3. Verify user permissions and roles in WordPress.

Other vulnerabilities in Contextual Related Posts

CVE-2026-85653Medium
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' Block Parameter in all versions up to and including 4.4.1 due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Original NVD description (English source)

Missing Authorization vulnerability in WebberZone Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/a through 4.5.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS