CVE-2021-36872: WordPress Popular Posts Project WordPress Popular Posts

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widget-wpp[2][post_type].

Affected products

• WordPress Popular Posts Project WordPress Popular Posts: up to and including 5.3.3

Published 2021-09-23. Last modified 2026-06-17.