Query Posts
Query Posts has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Query Posts has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Muhammad Yudha - DJ. Query Posts is installed on roughly 700 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 3.0.5.
CVE-2025-62905Query Posts <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Query Posts
Author
Justin Tadlock
The Query Posts widget was written to allow users that don’t know their way around PHP to easily show posts in any way they’d like. It’s like having a cool WordPress developer as a friend ready to do your bidding. Seriously. The widget has over 40 options to choose from. You can list posts by category, tag, custom taxonomies, author, date, time, name, or anything you can imagine. You can choose to show the full content, excerpts, or even a simple list. You can order the posts in all sorts of ways. Oh, and you can even show pages. This is the widget that keeps users out of the code and gives them the ability to display items on their site how they want.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C