CVE-2024-3554 All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on...

CVE-2024-3554

CVE-2024-3554 is a stored XSS vulnerability in the All in One SEO – Best WordPress SEO Plugin (WordPress) up to version 4.6.0. Root cause: inadequate input sanitization and output escaping in shortcode attributes, allowing an attacker with contributor-level access or higher to inject arbitrary sc...

WordPress All In One SEO Pack Plugin <= 4.6.0 is vulnerable to Cross Site Scripting (XSS)

Software All In One SEO Pack Type Plugin Vulnerable versions = 4.6.0 Fixed in 4.6.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3554 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID afa993c33fdc Credits Krzysztof Zając...