ParOne Feeds

ParOne Feeds has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for ParOne Feeds has a vendor fix available, so running the current release closes it.

All of these findings were reported by SOPROBRO. ParOne Feeds is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all ParOne Feeds vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2024-51874

ParOne Feeds <= 1.17.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records


2024-11-08 00:00	ParOne Feeds <= 1.17.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ParOne Feeds <= 1.17.1	`CVE-2024-51874`	6.4 Medium	SOPROBRO	Yes

Showing 1–1 of 1 reports

Plugin Profile

Latestv1.8.2

ParOne Feeds

Author

ParOne, Inc

0.0(0)

0/100

Last Updated

2026-07-13 (2mo ago)

Active Installs

10+

Downloads

25,374

Requires WP

5.1+

Requires PHP

7.2+

Tested up to

WP 7.0.4

Created

2021-05-06 (5y ago)

This plugin is a tool for distributing ParOne, Inc video feeds into WordPress installations. This plugin is a tool for distributing golf video supplied by ParOne, Inc into WordPress installations. Users of this plugin have registered with ParOne, Inc to distribute content into their WordPress site. More information about ParOne can be found here. How it works This plugin installs ParOne’s custom video player web components via CDN, and provides shortcodes for including those components in WordPress pages and posts. The video player web components interact with ParOne as an external service. In addition, this plugin allows the WordPress administrator to configure auto-posting of video content into WordPress. The interaction with the ParOne video service consists of 3 types of interactions: Downloading the script which contains the video player web components Calling ParOne’s content API to request lists of eligible videos Calling ParOne’s tracking API to signal when a video starts to be played, and when the playhead hits 5, 15, and 30 seconds ParOne collects no personally identifiable information. Tracking calls are used for registering views on WordPress sites. This plugin includes shortcodes which can be placed on any page. Support Technical documentation can be found here

View on WordPress.org