WordPress plugin
Most And Least Read Posts Widget security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 3 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium2
- Low0
All Most And Least Read Posts Widget vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤2.5.20Update to 2.5.21 | CVE-2025-39549 | |
| Medium4.3 | Cross-Site Request Forgery via most_and_least_read_posts_options ≤2.5.18Update to 2.5.19 | CVE-2024-49628 | |
| High8.8 | Authenticated(Contributor+) SQL Injection via Widget settings <2.5.17Update to 2.5.17 | CVE-2023-52133 |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.5.20Update to 2.5.21
- Medium4.3Cross-Site Request Forgery via most_and_least_read_posts_options
≤2.5.18Update to 2.5.19
- High8.8Authenticated(Contributor+) SQL Injection via Widget settings
<2.5.17Update to 2.5.17
Most And Least Read Posts Widget: common questions
Does Most And Least Read Posts Widget have known vulnerabilities?
Yes. VulnCrest Radar lists 3 known vulnerabilities in Most And Least Read Posts Widget: 1 high, 2 medium. None are known to affect version null.
How do I check which version of Most And Least Read Posts Widget I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Most And Least Read Posts Widget vulnerability?
CVE-2025-39549, published Apr 16, 2025: Most And Least Read Posts Widget <= 2.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any Most And Least Read Posts Widget vulnerability listed in CISA KEV?
No. None of the known Most And Least Read Posts Widget vulnerabilities is currently listed in the CISA KEV catalog.