SEOPress WordPress plugin stored XSS via analytics tracking settings
A WordPress SEO plugin can secretly run bad code in visitors' browsers.
Summary
The SEOPress WordPress plugin does not sanitise analytics tracking settings, so users granted a delegated capability can run malicious scripts in the browser of any site visitor. Versions before 10.4 are affected.
Affected when
- a user holding a capability the administrator delegated to them
What to do
Update SEOPress to 10.4 or later.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen