WordPress CVEs

Description

The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post

Affected WordPress components

• SEOPress – AI SEO Plugin & On-site SEO Plugin · wp-seopress
  Confirmed match Active
  Before 7.8
  View on WordPress.org
• seopress Plugin · seopress
  Possible match Homeless
  Before 7.8
  View on WordPress.org
• SEOPress Theme · seopress
  Possible match Abandoned
  Before 7.8
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown SEOPress — Before 7.8
• seopress seopress — Before 7.8

References

• wpscan.com https://wpscan.com/vulnerability/a56ad272-e2ed-4064-9b5d-114a834dd8b3/ Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record