Plugin security history

Contextual Related Posts Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 9 vulnerability records associated with Contextual Related Posts, published between 2014 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

9Total records

1Critical

1High

7Medium

0Low

0Informational

9Patched records

0Currently marked unpatched

2014-03-06First disclosure

2026-04-17Latest disclosure

6 of 9CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2014	2	2 records
2020	1	1 records
2023	3	3 records
2025	1	1 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
Critical	1	11.1%
High	1	11.1%
Medium	7	77.8%

Vulnerability-Type Breakdown

CSRF

3 records33.3%

First: 2014. Latest: 2023.

Cross-Site Scripting

3 records33.3%

First: 2023. Latest: 2026.

Missing Authorization

2 records22.2%

First: 2023. Latest: 2026.

SQL Injection

1 record11.1%

First: 2014. Latest: 2014.

Patch Status

Patched: 9
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.2.2
4.0.3
3.3.2
3.3.1
2.9.4
1.8.7
1.8.10.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.2.1`	Contextual Related Posts <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes'	April 17, 2026	4.2.2	Medium
`[*, 4.2.2)`	Contextual Related Posts < 4.2.2 - Missing Authorization	March 18, 2026	4.2.2	Medium
`*-4.0.2`	Contextual Related Posts <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 7, 2025	4.0.3	Medium
`*-3.3.1`	Contextual Related Posts <= 3.3.1 - Cross-Site Request Forgery in crpClearCache	February 20, 2023	3.3.2	Medium
`*-3.3.1`	Contextual Related Posts <= 3.3.1 - Missing Authorization in crp_ajax_clearcache	February 20, 2023	3.3.2	Medium
`*-3.3.0`	Contextual Related Posts <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute	January 5, 2023	3.3.1	Medium
`*-2.9.3`	Contextual Related Posts <= 2.9.3 - Cross-Site Request Forgery	November 19, 2020	2.9.4	Medium
`*-1.8.6`	Contextual Related Posts <= 1.8.6 - Cross-Site Request Forgery to Cross-Site Scripting	August 1, 2014	1.8.7	High
`[*, 1.8.10.2)`	Contextual Related Posts < 1.8.10.2 - SQL Injection	March 6, 2014	1.8.10.2	Critical

Selected source records

Latest Records

MediumCVE-2026-2986

Contextual Related Posts <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes'

Published: April 17, 2026

Affected versions: *-4.2.1
Patched versions: 4.2.2

Original Wordfence record

MediumCVE-2026-32565

Contextual Related Posts < 4.2.2 - Missing Authorization

Published: March 18, 2026

Affected versions: [*, 4.2.2)
Patched versions: 4.2.2

Original Wordfence record

MediumCVE-2025-47506

Contextual Related Posts <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 7, 2025

Affected versions: *-4.0.2
Patched versions: 4.0.3

Original Wordfence record

Medium

Contextual Related Posts <= 3.3.1 - Missing Authorization in crp_ajax_clearcache

Published: February 20, 2023

Affected versions: *-3.3.1
Patched versions: 3.3.2

Original Wordfence record

Medium

Contextual Related Posts <= 3.3.1 - Cross-Site Request Forgery in crpClearCache

Published: February 20, 2023

Affected versions: *-3.3.1
Patched versions: 3.3.2

Original Wordfence record

MediumCVE-2023-0252

Contextual Related Posts <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute

Published: January 5, 2023

Affected versions: *-3.3.0
Patched versions: 3.3.1

Original Wordfence record

Medium

Contextual Related Posts <= 2.9.3 - Cross-Site Request Forgery

Published: November 19, 2020

Affected versions: *-2.9.3
Patched versions: 2.9.4

Original Wordfence record

HighCVE-2013-2710

Contextual Related Posts <= 1.8.6 - Cross-Site Request Forgery to Cross-Site Scripting

Published: August 1, 2014

Affected versions: *-1.8.6
Patched versions: 1.8.7

Original Wordfence record

Highest-Severity Records

CriticalCVE-2014-3937

Contextual Related Posts < 1.8.10.2 - SQL Injection

Published: March 6, 2014

Affected versions: [*, 1.8.10.2)
Patched versions: 1.8.10.2

Original Wordfence record

HighCVE-2013-2710

Contextual Related Posts <= 1.8.6 - Cross-Site Request Forgery to Cross-Site Scripting

Published: August 1, 2014

Affected versions: *-1.8.6
Patched versions: 1.8.7

Original Wordfence record

MediumCVE-2025-47506

Contextual Related Posts <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 7, 2025

Affected versions: *-4.0.2
Patched versions: 4.0.3

Original Wordfence record

MediumCVE-2026-2986

Contextual Related Posts <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes'

Published: April 17, 2026

Affected versions: *-4.2.1
Patched versions: 4.2.2

Original Wordfence record

MediumCVE-2023-0252

Contextual Related Posts <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute

Published: January 5, 2023

Affected versions: *-3.3.0
Patched versions: 3.3.1

Original Wordfence record

MediumCVE-2026-32565

Contextual Related Posts < 4.2.2 - Missing Authorization

Published: March 18, 2026

Affected versions: [*, 4.2.2)
Patched versions: 4.2.2

Original Wordfence record

Medium

Contextual Related Posts <= 3.3.1 - Missing Authorization in crp_ajax_clearcache

Published: February 20, 2023

Affected versions: *-3.3.1
Patched versions: 3.3.2

Original Wordfence record

Medium

Contextual Related Posts <= 3.3.1 - Cross-Site Request Forgery in crpClearCache

Published: February 20, 2023

Affected versions: *-3.3.1
Patched versions: 3.3.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory