CVE-2021-20746

Vulnerability

WordPress Popular Posts plugin version 5.3.2 and earlier is vulnerable to cross-site scripting (XSS) [3]. The vulnerability occurs via unspecified vectors, allowing a remote authenticated attacker to inject arbitrary scripts [1]. The plugin is developed by Héctor Cabrera [4].

Exploitation

An attacker must have administrative privileges on the WordPress instance [3]. The attack vector is network-based, requires low complexity, and requires user interaction [3]. The attacker can inject and execute arbitrary script in the context of the administrator's browser session [3].

Impact

Successful exploitation allows the attacker to execute arbitrary scripts in the web browser of an administrative user [3]. This can lead to disclosure of sensitive information, modification of site content, or further compromise of the WordPress installation, with a CVSS v3 score indicating low confidentiality and low integrity impact [3].

Mitigation

The vendor recommends updating the plugin to a version later than 5.3.2 [1][3]. The latest version is 7.3.8 as of 2026-02-17 [2]. Users should update to the most recent version to remediate the vulnerability. No workaround is mentioned in the references.