WordPress CVEs

Description

The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3.

Affected WordPress components

• SEOPress – AI SEO Plugin & On-site SEO Plugin · wp-seopress
  Confirmed match Active
  Version 5.0.0; Version 5.0.1; Version 5.0.2; Version 5.0.3
  View on WordPress.org
• seopress Plugin · seopress
  Possible match Homeless
  From 5.0.0 (including) to 5.0.4 (excluding)
  View on WordPress.org
• SEOPress Theme · seopress
  Possible match Abandoned
  From 5.0.0 (including) to 5.0.4 (excluding)
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• SEOPress SEOPress — Version 5.0.0
• SEOPress SEOPress — Version 5.0.1
• SEOPress SEOPress — Version 5.0.2
• SEOPress SEOPress — Version 5.0.3
• seopress seopress — From 5.0.0 (including) to 5.0.4 (excluding)

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wp-seopress/tags/5.0.4/src/Actions/Api/TitleDescriptionMeta.php#L78 Exploit, Third Party Advisory
• www.wordfence.com https://www.wordfence.com/blog/2021/08/xss-vulnerability-patched-in-seopress-affects-100000-sites/ Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record