Google Web Stories vulnerabilities

3 CVEs affecting Google Web Stories, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-54317, published 2024-12-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-3708, published 2022-10-28. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found…
CVE-2023-1979, published 2023-05-08. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the…
CVE-2024-54317, published 2024-12-13. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Google Web Stories web-stories allows Stored XSS.This issue affects Web Stories: from n/a through…