Weaver Show Posts
Weaver Show Posts has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 6.6 out of 10. 2023 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Deserialization Of Untrusted Data.
Every one of the 3 issues recorded for Weaver Show Posts has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Weaver Show Posts is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2023-3360Weaver Show Posts <= 1.8.0 - Authenticated (Administrator+) PHP Object Injection
Read the full analysisVulnerability Records

Weaver Show Posts
Author
wpweaver
This plugin provides a very flexible way to show posts anywhere on a site using a shortcode. It works with any theme. Weaver Show Posts is by far the most flexible with an easy to use interface to select which posts to show. Note: this plugin was formerly named ATW Show Posts. There is no difference in functionality between the versions. Easy to select which posts to show There are several WordPress plugins that allow you to display selected posts via shortcode on your pages, other posts, or in widgets. This plugin provides a powerful interactive admin page that allows you to specify exactly which posts you want displayed. The specifications are called a “filter”, and you can define as many filters as you need to display different posts via the shortcode. Includes support for custom post types and taxonomies. Style of Displayed Posts Weaver Show Posts will normally display posts using its own basic display functions. These can be easily styled to match the rest of your site by defining Custom CSS rules in the Custom CSS option. But Weaver Show Posts can go way beyond that. For many Themes, you can elect to use the native Theme Post formatting function. The posts displayed by Show Posts will match other posts displayed by your theme. If you are using the Weaver Xtreme or Weaver II themes, there is even more integrated display of posts. Show Posts in a Text Widget You can add [show_posts] to the standard Text Widget. If your theme or other plugin doesn’t add this capability, Weaver Show Posts includes an option to allow the Text Widget to support shortcodes. The Shortcode The form of the shortcode is: [show_posts filter=filter-name]
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C