CVE-2019-13478

The CVE-2019-13478 entry describes a vulnerability in the WordPress Yoast SEO plugin prior to 11.6-RC5 where unfiltered HTML in term descriptions is not properly restricted, enabling cross-site scripting. Affected software is the Yoast SEO plugin for WordPress (versions before 11.6-RC5). Impact, ...

PT-2019-13358 · Yoast · Yoast Seo Plugin

Name of the Vulnerable Software and Affected Versions: Yoast SEO plugin versions prior to 11.6-RC5 Description: The issue concerns the improper restriction of unfiltered HTML in term descriptions, which could lead to potential security risks. Recommendations: For versions prior to 11.6-RC5, updat...

Yoast SEO 1.2.0-11.5 - Authenticated Stored XSS

The vendor's description, reference included below: "Yoast SEO 11.6 also fixes a security issue regarding term pages in WordPress. Unfiltered code was allowed in some fields. This, however, does not pose a problem for single user sites. In specific cases, on multisite installs, this might become ...

WordPress Yoast SEO Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Yoast SEO Plugin versions prior to 11.6-RC5, which ca...

CVE-2019-13478: Improper Neutralization of Input During Web Page Generation

The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions...

WordPress SEO By Rank Math plugin <= 1.0.27 - Authenticated Settings Reset vulnerability

Authenticated Settings Reset vulnerability found in WordPress SEO By Rank Math plugin versions = 1.0.27. Solution Update the WordPress SEO By Rank Math plugin to the latest available version at least 1.0.27.1...

WordPress SEO by Rank Math plugin <= 1.0.26 - Cross-Site Scripting (XSS) vulnerabilities

Cross-Site Scripting XSS vulnerabilities found in WordPress SEO by Rank Math versions = 1.0.26. Solution Update the WordPress SEO by Rank Math to the latest available version at least 1.0.27...

WordPress Sites Worldwide Hit with 'Call-Girl' Search-Engine Pollution

A web spam campaign that targets Koreans is creating problems for site administrators all around the world. Hackers are compromising vulnerable Korean-language WordPress websites, but are also polluting search engine results for non-hacked sites globally. Researchers at Sucuri initially uncovered...

Seo Panel Newsletter 1.2.0 Cross Site Scripting

Exploit Title: Seo Panel Plugin Newsletter 1.2.0 - 'plugins/newsletter/unsubscribemaillist.php email' Cross-site Scripting Google Dork: N/A Date: 15 April 2019 Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me Vendor Homepage: http://sp.seopanel.in/...

File Upload Vulnerability in Super CMS

Super CMS content management system by the SEO Research Center moonseo.cn in order to solve the problem of website optimization and development of a set of products. Super CMS has a file upload vulnerability that can be exploited by attackers to upload malicious w files and gain server privileges...

vBulletin 3.8.4 Zoints SEO 2.3.2 Open Redirection

Exploit Title : vBulletin 3.8.4 Zoints SEO 2.3.2 Computer-Logic Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 01/03/2019 Vendor Homepages : zoints.com computer-logic.org Software Information Links : vbulletin.org/forum/showthread.php?t=127336...

vBulletin 4.x.x DragonByte SEO 2.0.31 Open Redirection

Exploit Title : vBulletin 4.x.x DragonByte SEO v2.0.31 Pro Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 28/02/2019 Vendor Homepages : vbulletin.com dragonbyte-tech.com Vendor Name : DragonByte Technologies Software Information Link :...

SchoolCMS V2.3.1 Code Execution Vulnerability in Backend Se***.cl***.php

SchoolCMS is a school teaching management system based on PHP+MySQL. A code execution vulnerability exists in Schoolcms V2.3.1 backend SeoController.class.php. An attacker can exploit this vulnerability to execute arbitrary code...

WordPress Yoast SEO Plugin < 9.2.0 Race Condition Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112515";...

WordPress WP-JS-External-Link-Info 2.2.0 Open Redirection

Exploit Title : WordPress WP-JS-External-Link-Info Plugins 2.2.0 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/02/2019 Vendor Homepage : finewebdev.com Software Download Link : downloads.wordpress.org/plugin/wp-external-links.1.81.zip...

Google URL Inspection Tool flaw lets anyone inspect URLs without authorization

By Waqas Last year, Google launched its URL Inspection Tool for webmasters using Search Console. The purpose of this tool is to provide information about Google's indexed version of a specific page. However, now, a UK-based Search Engine Optimization SEO specialist Oliver HG Mason has discovered...

WordPress Targeted with Clever SEO Injection Malware

A clever malware built for SEO injection – where a black hat loads up a webpage with spammy links, redirects and ad keywords, unbeknownst to the site owner – has been seen evading detection with an innovative approach that involves appending itself in an unusual place in the back-end code of a...

Domain Name Consolidation - Observations from the Field

Domain Name Consolidation The market and marketing of Web property domain names is changing. Companies prefer to promote top level domains TLDs, have the option of selecting brand-relevant domain extensions e.g. SaaS.com, and no longer need country-relevant domains to optimize search engine resul...

Remote Code Execution (RCE)

yoast/wordpress-seo is vulnerable to remote code execution. An SEO Manager is able to execute arbitrary OS commands via a ZIP import through a race condition vulnerability in unzipfile in admin/import/class-import-settings.php...

WordPress Yoast SEO Plugin Competitive Conditions Vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. Yoast SEO wordpress-seo plugin is used in one of the search engine optimization plugin. A competitive conditio...