WordPress plugin
Magical Posts Display – Elementor Advanced Posts widgets security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High0
- Medium5
- Low0
All Magical Posts Display – Elementor Advanced Posts widgets vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widget ≤1.2.54Update to 1.2.55 | CVE-2025-12965 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.2.52Update to 1.2.53 | CVE-2025-54706 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.2.38Update to 1.2.39 | CVE-2024-37951 | |
| Medium4.3 | Missing Authorization ≤3.6.0Update to 3.6.1 | — | |
| Medium4.3 | Cross-Site Request Forgery ≤3.6.0Update to 3.6.1 | CVE-2022-47150 |
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widget
≤1.2.54Update to 1.2.55
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.2.52Update to 1.2.53
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.2.38Update to 1.2.39
- Medium4.3Missing Authorization
≤3.6.0Update to 3.6.1
- Medium4.3Cross-Site Request Forgery
≤3.6.0Update to 3.6.1
Magical Posts Display – Elementor Advanced Posts widgets: common questions
Does Magical Posts Display – Elementor Advanced Posts widgets have known vulnerabilities?
Yes. VulnCrest Radar lists 5 known vulnerabilities in Magical Posts Display – Elementor Advanced Posts widgets: 5 medium. At least one is not fixed in the latest version.
How do I check which version of Magical Posts Display – Elementor Advanced Posts widgets I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Magical Posts Display – Elementor Advanced Posts widgets vulnerability?
CVE-2025-12965, published Dec 11, 2025: Magical Posts Display <= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widget. Severity: Medium (CVSS 6.4).
Is any Magical Posts Display – Elementor Advanced Posts widgets vulnerability listed in CISA KEV?
No. None of the known Magical Posts Display – Elementor Advanced Posts widgets vulnerabilities is currently listed in the CISA KEV catalog.