WordPress CVEs

Description

The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.

Affected WordPress components

• SEOPress – AI SEO Plugin & On-site SEO Plugin · wp-seopress
  Confirmed match Active
  Before 7.8
  View on WordPress.org
• seopress Plugin · seopress
  Possible match Homeless
  Before 7.8
  View on WordPress.org
• SEOPress Theme · seopress
  Possible match Abandoned
  Before 7.8
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown SEOPress — Before 7.8
• seopress seopress — Before 7.8

References

• wpscan.com https://wpscan.com/vulnerability/15346ae9-9a29-4968-a6a9-81d1116ac448/ Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record