EUVD-2026-79285

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

CVE-2024-4041

CVE-2024-4041 Yoast SEO /?page=%22%20onmouseover%3D%22alertdocument.domain%22%20x%3D%22 3. 管理バーでYoastメニューを開き、Get Yoast SEO Premium にカーソルを合わせるかクリックします。 4. 注入されたイベントハンドラonmouseoverからJavaScriptが実行され、反射型XSSが確認されます。...

CVE-2026-78152

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

CVE-2026-78152

SureRank SEO WordPress plugin versions 1.6.2 through 1.10.0 fail to exclude registered account email addresses from the Person Schema structured data it outputs on public pages by default. This allows unauthenticated visitors to enumerate the email addresses of any user who has published content,...

EUVD-2026-76809

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

CVE-2026-78152 SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

CVE-2024-12252

SEO LAT Auto Post = 2.2.1 - 远程代码执行 描述 WordPress 的 SEO LAT Auto Post 插件在 2.2.1 及之前的所有版本中，由于对 remoteupdate AJAX 操作缺少能力检查，因而存在文件覆盖漏洞。这使得未认证的攻击者能够覆盖 seo-beginner-auto-post.php 文件，并借此实现远程代码执行。 漏洞详情 CVE : CVE-2024-12252 CVSS 分数 : 9.8（严重） 漏洞利用 该脚本通过覆盖 seo-beginner-auto-post.php 文件来利用 SEO LAT Auto Post...

CVE-2026-62113

Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...

CVE-2026-62113 WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability

Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...

CVE-2026-62113

CVE-2026-62113 is an Insecure Direct Object References (IDOR) vulnerability in the WordPress plugin Slim SEO (versions

EUVD-2026-76207

Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...

WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Sybre Waaijer in WordPress Plugin Slim SEO versions = 4.10.0...

CVE-2024-12252

CVE-2024-12252 SEO LAT Auto Post = 2.2.1 - 缺少授权导致文件覆盖/上传（远程代码执行） 描述 WordPress 的 SEO LAT Auto Post 插件在 2.2.1 及之前的所有版本中，由于 remoteupdate AJAX 操作缺少权限检查，因此存在文件覆盖漏洞。这使得未认证的攻击者能够覆盖 seo-beginner-auto-post.php 文件，并借此实现远程代码执行。 详细信息 类型 ：plugin Slug ：seo-beginner-auto-post 受影响版本 ：2.2.1 CVSS 分数 ：9.8 CVSS 评级 ：...

preflight v0.22.0

Preflight.sh Preflight.sh is a command-line tool that scans your codebase for launch readiness. Identifies missing configuration, integration issues, security concerns, SEO metadata gaps, and other common mistakes before you deploy to production. Don't embarrass yourself in production. Just run t...

BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams

Cybersecurity researchers have disclosed details of a sprawling search engine optimization SEO poisoning campaign that paves the way for malware deployment and tech support scams. The campaign, discovered by the DFIR Report in March 2026, has been codenamed BengalSEO. It has operated out of the...

CVE-2026-78362

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site...

CVE-2026-15247

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...

EUVD-2026-71851

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site...

CVE-2026-78362

SEO Flow by LupsOnline WordPress plugin versions 3.0.0 through 3.0.2 suffer from an unauthenticated privilege escalation via incorrect validation of the API key supplied with API requests. An unauthenticated attacker can be served as the administrator who configured the plugin, enabling full site...

CVE-2026-78362 SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site...