PT-2026-113656

The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it...

CVE-2026-19856

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

CVE-2026-19856

The All in One SEO WordPress plugin versions prior to 5.0.2.1 contains a vulnerability where it fails to correctly identify which shortcodes are present in content derived from user input before stripping them. This flaw allows unauthenticated users to execute arbitrary shortcodes registered on t...

EUVD-2026-91769

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

PT-2026-104415

Name of the Vulnerable Software and Affected Versions All in One SEO versions prior to 5.0.2.1 Description Unauthenticated users can execute arbitrary shortcodes registered on the site because the plugin fails to correctly determine which shortcodes are present in content derived from user input...

CVE-2026-14812: Hidden Functionality

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker...

PT-2026-68646

Name of the Vulnerable Software and Affected Versions Premium SEO WordPress plugin affected versions not specified Description The Premium SEO WordPress plugin is malicious and contains an unauthenticated backdoor. This backdoor allows an unauthenticated attacker to create a hidden administrator...

EUVD-2026-47884

The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data...

CVE-2026-12082: Missing Authorization

The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data...

CVE-2026-57761

Unauthenticated Cross Site Request Forgery CSRF in SEOWP = 3.12.2 versions...

PT-2026-55048

Unauthenticated Cross Site Request Forgery CSRF in SEOWP = 3.12.2 versions...

EUVD-2024-35067

Malicious code in bioql PyPI...

EUVD-2022-15778

Malicious code in bioql PyPI...

CVE-2024-34801

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mervin Praison Praison SEO WordPress seo-wordpress allows DOM-Based XSS.This issue affects Praison SEO WordPress: from n/a through = 4.0.15...

PT-2024-16309

Name of the Vulnerable Software and Affected Versions The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin versions prior to 1.5.0 Description The issue concerns the failure to sanitise uploaded SVG files, potentially allowing users with a role as lo...

CVE-2024-4627: Improper Neutralization of Input During Web Page Generation

The Rank Math SEO WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to the General Settings by default admin, however such access can be given to lower roles via the Role Manager feature of the Rank Math SEO WordPress plugin...

Yoast SEO Plugin for WordPress < 22.6 Cross-Site Scripting

The WordPress Yoast SEO Plugin installed on the remote host is affected by a reflected Cross-Site Scripting XSS vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

CVE-2024-34801

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mervin Praison Praison SEO WordPress seo-wordpress allows DOM-Based XSS.This issue affects Praison SEO WordPress: from n/a through = 4.0.15...

CVE-2024-34801: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mervin Praison Praison SEO WordPress seo-wordpress allows DOM-Based XSS.This issue affects Praison SEO WordPress: from n/a through = 4.0.15...

CVE-2024-4082: Cross-Site Request Forgery (CSRF)

The Joli FAQ SEO – WordPress FAQ Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the...