WordPress SEO URL Redirects LlamasApps Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software SEO URL Redirects LlamasApps Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d63e22bcb649 Credits Rafie Muhammad Patchsta...

WordPress plugin SEO Redirection 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2021-24396

A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24396: Improper Neutralization of Special Elements used in an SQL Command

A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-34665

The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saqtxtthefilter parameter in the /wp-seo-tags.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.7...

CVE-2021-24307: Deserialization of Untrusted Data

The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseotoolssettings" privilege most of the time admin to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup...

WordPress SEO Redirection plugin <= 6.3 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze Patchstack Red Team in WordPress SEO Redirection plugin versions = 6.3. Solution Update the WordPress SEO Redirection plugin to the latest available version at least 6.4...

WordPress SEO Plugin - Rank Math < 1.0.41 - Privilege Escalation via Unprotected REST API Endpoint

This plugin registered a REST-API endpoint, rankmath/v1/updateMeta, which failed to include a permissioncallback used for capability checking. The endpoint called a function, updatemetadata which could be used to update the slug on existing posts, or could be used to delete or update metadata for...

WordPress SEO Plugin - Rank Math < 1.0.41 - Privilege Escalation via Unprotected REST API Endpoint

This plugin registered a REST-API endpoint, rankmath/v1/updateMeta, which failed to include a permissioncallback used for capability checking. The endpoint called a function, updatemetadata which could be used to update the slug on existing posts, or could be used to delete or update metadata for...

Remote Code Execution (RCE)

yoast/wordpress-seo is vulnerable to remote code execution. An SEO Manager is able to execute arbitrary OS commands via a ZIP import through a race condition vulnerability in unzipfile in admin/import/class-import-settings.php...

CVE-2018-19370

The CVE-2018-19370 entry concerns Yoast SEO (wordpress-seo) plugin for WordPress, specifically versions before 9.2.0. A race-condition in unzip_file (admin/import/class-import-settings.php) allows an SEO Manager to execute OS commands via a ZIP import. Public sources in the connected documents co...

Uber: XSS in people.uber.com

From the HTML source code of http://people.uber.com I came to know that it uses Yoast WordPress SEO plugin v2.1.1 But it is known to suffer from XSS bug. Check it for more details and steps: https://wpvulndb.com/vulnerabilities/8045 Bug can be easily fixed upgrading the plugin. Thanks...

Wordpress Seo Link Rotator 插件-pusher.php文件title参数--跨站脚本漏洞

漏洞详情 漏洞标题 : Wordpress Seo Link Rotator 插件-pusher.php文件title参数--跨站脚本漏洞 插件首页 : http://www.seolinkrotator.com 下载链接 : http://www.seolinkrotator.com/download/files/seolinkrotator.zip 存在跨站漏洞的文件为pusher.php ，未做输入输出转义过滤: Link To This If you would like to share this with someone else just copy and paste th...

CVE-2012-6692: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the posttitle parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview...

Popular WordPress SEO Plugin Fixes XSS Bug

The Yoast WordPress SEO plugin, which has been downloaded more than 14 million times, has a serious cross-site scripting vulnerability that can allow an attacker to force a vulnerable site to execute arbitrary HTML code. The bug may have been reported to the plugin’s developer as long as two year...

WordPress Yoast 2.1.1 Cross Site Scripting

============================================================ Info ============================================================ Affects: Yoast Wordpress SEO Plugin ============================================================ Vulnerable Code =================================...

CVE-2015-2293

Multiple cross-site request forgery CSRF vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that...

KLA10481 Multiple vulnerabilities in WordPress SEO plugin

Multiple CSRF and SQL injection vulnerabilities were found in WordPress SEO plugin. These vulnerabilities can be exploited remotely via vectors related to wpseobulk-editor page. Original advisories Plugin changelog Exploitation Public exploits exist for this vulnerability. Related products...

CVE-2015-2292: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in...