WordPress CVEs

Description

The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected WordPress components

• SEOPress – AI SEO Plugin & On-site SEO Plugin · wp-seopress
  Confirmed match Active
  Before 7.3
  View on WordPress.org
• seopress Plugin · seopress
  Possible match Homeless
  Before 7.3
  View on WordPress.org
• SEOPress Theme · seopress
  Possible match Abandoned
  Before 7.3
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown SEOPress — Before 7.3
• seopress seopress — Before 7.3

References

• wpscan.com https://wpscan.com/vulnerability/78a13958-cd12-4ea8-b326-1e3184da970b/ Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record