CVE-2023-0585: XSS
First published: Fri Feb 24 2023(Updated: )
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All In One SEO Pack | <=4.2.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Main/Updates.php?v=2829340#L624
- https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Main/Updates.php?v=2829340#L625
- https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Main/Updates.php?v=2829340#L665
- https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Main/Updates.php?v=2829340#L666
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2859011%40all-in-one-seo-pack%2Ftrunk&old=2847431%40all-in-one-seo-pack%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3db97180-9308-4891-9de9-acefe31d088f
Frequently Asked Questions
What is CVE-2023-0585?
CVE-2023-0585 is a vulnerability in the All in One SEO Pack plugin for WordPress that allows authenticated attackers to conduct stored cross-site scripting attacks.
What is the severity of CVE-2023-0585?
The severity of CVE-2023-0585 is medium with a CVSS score of 4.8.
How does CVE-2023-0585 affect the All in One SEO Pack plugin?
CVE-2023-0585 affects the All in One SEO Pack plugin for WordPress versions up to 4.2.9 by allowing stored cross-site scripting attacks.
What is stored cross-site scripting?
Stored cross-site scripting (XSS) is a type of XSS attack where the malicious script is permanently stored on a target server and is rendered to users when they visit the affected page.
Is there a fix for CVE-2023-0585?
Yes, updating the All in One SEO Pack plugin to a version beyond 4.2.9 will fix the vulnerability.
- agent/references
- agent/type
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/aioseo
- canonical/all in one seo pack
- version/all in one seo pack/4.2.9