First published: Mon Jun 05 2023(Updated: )
The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Credit: contact@wpscan.com contact@wpscan.com
Affected Software | Affected Version | How to fix |
---|---|---|
10web Seo | <1.2.7 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this vulnerability is CVE-2023-2224.
The severity of CVE-2023-2224 is medium with a severity value of 4.8.
The SEO by 10Web WordPress plugin before 1.2.7 is affected by CVE-2023-2224.
CVE-2023-2224 allows high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks.
To fix CVE-2023-2224, update the SEO by 10Web WordPress plugin to version 1.2.7 or higher.