PT-2025-6151 · Meta · Imessenger

Name of the Vulnerable Software and Affected Versions: WP SEO Plugin affected versions not specified Description: The issue concerns a SQL injection in the WP SEO Plugin. There is also mention of a Denial of Service DoS vulnerability affecting Messenger Group Calls on iOS devices. Recommendations...

DragonRank Exploits IIS Servers with BadIIS Malware for SEO Fraud and Gambling Redirects

Threat actors have been observed targeting Internet Information Services IIS servers in Asia as part of a search engine optimization SEO manipulation campaign designed to install BadIIS malware. "It is likely that the campaign is financially motivated since redirecting users to illegal gambling...

CVE-2025-25147

Cross-Site Request Forgery CSRF vulnerability in Phillip.Gooch Auto SEO auto-seo allows Stored XSS.This issue affects Auto SEO: from n/a through = 2.5.6...

CVE-2025-25138

Cross-Site Request Forgery CSRF vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + Whatsapp Chat Button: from n/a through = 2.0.0...

CVE-2025-25147

Cross-Site Request Forgery CSRF vulnerability in Phillip.Gooch Auto SEO auto-seo allows Stored XSS.This issue affects Auto SEO: from n/a through = 2.5.6...

CVE-2025-25138

Cross-Site Request Forgery CSRF vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + Whatsapp Chat Button: from n/a through = 2.0.0...

CVE-2025-25147 WordPress Auto SEO plugin <= 2.5.6 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Phillip.Gooch Auto SEO auto-seo allows Stored XSS.This issue affects Auto SEO: from n/a through = 2.5.6...

CVE-2025-25138

CVE-2025-25138 is a CSRF to Stored XSS vulnerability in the WordPress On Page SEO + Social Live Chat (formerly OPS) plugin that affects versions up to 2.0.0. CVSS 3.1 base score 7.1 (HIGH) with network attack vector, requiring user interaction. Exploit status is not publicly detailed in the docum...

CVE-2025-25147

CVE-2025-25147 is a CSRF-to-Stored-XSS vulnerability in the WordPress plugin Auto SEO (versions n/a through 2.5.6). The connected sources confirm the issue class and affected range, with remediation noted as updating to a version later than 2.5.6. The Wordfence vulnerability page lists the patch ...

CVE-2025-25138 WordPress On Page SEO + Social Live Chat (Formerly OPS) plugin <= 2.0.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Rishi On Page SEO + Whatsapp Chat Button allows Stored XSS. This issue affects On Page SEO + Whatsapp Chat Button: from n/a through 2.0.0...

CVE-2025-25147 WordPress Auto SEO plugin <= 2.5.6 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Phillip.Gooch Auto SEO allows Stored XSS. This issue affects Auto SEO: from n/a through 2.5.6...

CVE-2025-25138 WordPress On Page SEO + Social Live Chat (Formerly OPS) plugin <= 2.0.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + Whatsapp Chat Button: from n/a through = 2.0.0...

WordPress plugin On Page SEO + Whatsapp Chat Button 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

Chinese-Speaking Group Manipulates SEO with BadIIS

This blog post details our analysis of an SEO manipulation campaign targeting Asia. We also share recommendations that can help enterprises proactively secure their environment...

PT-2025-5956 · Unknown · Phillip.Gooch Auto Seo

Name of the Vulnerable Software and Affected Versions: Phillip.Gooch Auto SEO versions n/a through 2.5.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web applicatio...

WordPress plugin Auto SEO 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-23931

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Oliver Fuhrmann WordPress Local SEO dh-local-seo allows Blind SQL Injection.This issue affects WordPress Local SEO: from n/a through = 2.3...

CVE-2022-45065

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Squirrly SEO Plugin by Squirrly SEO plugin = 12.1.20 versions...

CVE-2019-13478

The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions...

CVE-2024-43286

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Squirrly SEO Plugin by Squirrly SEO.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.3.19...