Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Web StoriesWeb Stories Enhancer – Level Up Your Web StoriesWeb Stories Widgets For Elementor
Plugin · web-stories
Web Stories
2 known vulnerabilities on record. Add your version above to see which ones affect you.
Dec 13, 2024Web Stories: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54317 · affects up to 1.37.0 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Google Web Stories web-stories allows Stored XSS.This issue affects Web Stories: from n/a through <= 1.37.0.
Oct 28, 2022Web Stories: Server-Side Request ForgeryCVE-2022-3708 · affects up to 1.24.0 · reported by WordfenceCritical 9.6
The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.