CVE-2023-6961

CVE-2023-6961 : The WP Meta SEO WordPress plugin is affected by an unauthenticated Stored Cross-Site Scripting (XSS) via the Referer header in all versions up to 4.5.12 due to insufficient input sanitization and output escaping. Exploitation allows an attacker to inject scripts that execute in a ...

CVE-2023-0876

The CVE-2023-0876 vulnerability affects the WordPress plugin WP Meta SEO (versions prior to 4.5.3). It arises from insufficient authorization for several AJAX actions, enabling low-privilege users to perform updates to certain data and resulting in an arbitrary redirect vulnerability. Impactally,...

CVE-2023-1028

CVE-2023-1028: WP Meta SEO plugin for WordPress (versions

CVE-2023-1381

CVE-2023-1381 affects the WP Meta SEO WordPress plugin and is due to a deserialization flaw in PHAR handling when image file paths are not validated. The issue, observed in versions before 4.5.5, includes a gadget chain that may be leveraged in certain configurations to achieve remote code execut...

CVE-2022-30337

CVE-2022-30337 affects the WordPress WP Meta SEO plugin up to version 4.4.8. Several connected sources confirm a Cross-Site Request Forgery (CSRF) flaw that allows an attacker to update the plugin’s social settings, due to missing CSRF checks in the social settings update path. Multiple advisorie...

CVE-2023-1022

CVE-2023-1022 affects the WP Meta SEO WordPress plugin. Root cause: missing capability check in wpmsGGSaveInformation, with access control relying on nonce checks that are accessible to all authenticated users. Affected versions: up to and including 4.5.3. Impact: authenticated subscribers can up...

CVE-2022-1093

The WP Meta SEO WordPress plugin, prior to version 4.4.7, is vulnerable to a stored cross-site scripting (XSS) flaw in the breadcrumb separator. A high-privilege user (e.g., an administrator) can inject arbitrary JavaScript into pages where breadcrumbs are rendered, due to the separator not being...

CVE-2023-0875

CVE-2023-0875 affects the WP Meta SEO WordPress plugin, prior to version 4.5.3. The issue is a blind SQL injection caused by improper sanitization/escaping of inputs in SQL queries, which can be exploited by users with subscriber+ privileges. Exploitation details and PoCs are documented in connec...

CVE-2023-6962

CVE-2023-6962 affects the WP Meta SEO WordPress plugin, with a Sensitive Information Exposure vulnerability present in all versions up to and including 4.5.12, allowing unauthenticated attackers to disclose sensitive data via the meta description of password-protected posts. The linked records co...

CVE-2023-1029

CVE-2023-1029 affects the WP Meta SEO WordPress plugin, versions

CVE-2023-1026

Summary: CVE-2023-1026 affects the WP Meta SEO WordPress plugin (versions up to 4.5.3). The root cause is a missing capability check in the listPostsCategory function, causing unauthorized data access. The vulnerability arises because nonce-based access control was relied upon and the nonce was a...

CVE-2024-45455

CVE-2024-45455 is a stored XSS vulnerability in the WordPress plugin WP Meta SEO up to version 4.5.13, caused by improper neutralization of input during web page generation. Exploitation could affect authenticated users with administrator input and may lead to script execution in victims’ browser...

CVE-2023-1027

The CVE-2023-1027 issue affects the WP Meta SEO WordPress plugin up to version 4.5.3. Root cause: missing capability check in checkAllCategoryInSitemap, relying on nonce-based access control. Impact: authenticated users with subscriber-level access can generate sitemap data and obtain post catego...

CVE-2023-1023

The CVE-2023-1023 entry concerns the WordPress WP Meta SEO plugin. A missing capability check in the saveSitemapSettings function allows authenticated users with subscriber-level access to update sitemap-related plugin settings, due to reliance on a nonce-based access control that is accessible t...

CVE-2024-45456

The CVE-2024-45456 entry describes a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WP Meta SEO (versions

CVE-2023-1024

The CVE-2023-1024 entry concerns the WP Meta SEO WordPress plugin, where a missing capability check in regenerateSitemaps (versions up to 4.5.3) allows authenticated subscribers to generate sitemaps. Root cause: reliance on nonce-based access control, with nonces exposed to all authenticated user...