CVE-2024-4899 SEOPress < 7.8 - Contributor+ Stored XSS

2024-06-2406:00:01

WPScan

github.com

seopress

wordpress

stored xss

post settings

contributor

high privilege users

AI Score

5.7

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:seopress:seopress:-:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "seopress",
    "product": "seopress",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "7.8",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]