CVE-2019-16520

2019-10-1614:15:13

Google

osv.dev

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.2%

JSON

The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific description for posts provided by the plugin via unsafe placeholder replacement.

CPENameOperatorVersion
all-in-one-seo-packeq2.3-alpha
all-in-one-seo-packeq2.3.3.1
all-in-one-seo-packeq2.3.12.3
all-in-one-seo-packeq2.3.9.2
all-in-one-seo-packeq2.4.3
all-in-one-seo-packeq3.2.3
all-in-one-seo-packeq2.3.13.2
all-in-one-seo-packeq2.3.12.2.1
all-in-one-seo-packeq2.3.12.4
all-in-one-seo-packeq2.3.3.2

Name	Operator	Version
all-in-one-seo-pack	eq	2.3-alpha
all-in-one-seo-pack	eq	2.3.3.1
all-in-one-seo-pack	eq	2.3.12.3
all-in-one-seo-pack	eq	2.3.9.2
all-in-one-seo-pack	eq	2.4.3
all-in-one-seo-pack	eq	3.2.3
all-in-one-seo-pack	eq	2.3.13.2
all-in-one-seo-pack	eq	2.3.12.2.1
all-in-one-seo-pack	eq	2.3.12.4
all-in-one-seo-pack	eq	2.3.3.2