CVE-2023-6290: WP SEO Press < 7.3 - Admin+ Stored XSS
Published Jan 22, 2024
·Updated
The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed
Affected Software
1 affected component
SEOPress SEOPress WordPress<7.3
Event History
Jan 22, 2024
CVE Published
via MITRE·07:14 PM
Data Sourced
via MITRE·07:14 PM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-6290?
CVE-2023-6290 is a medium severity vulnerability that allows high privilege users to perform Cross-Site Scripting attacks.
2
How do I fix CVE-2023-6290?
To fix CVE-2023-6290, update the SEOPress WordPress plugin to version 7.3 or later.
3
Who is affected by CVE-2023-6290?
CVE-2023-6290 affects installations of the SEOPress plugin versions prior to 7.3 on WordPress.
4
What type of vulnerability is CVE-2023-6290?
CVE-2023-6290 is classified as a Cross-Site Scripting (XSS) vulnerability.
5
Can unfiltered_html be a mitigation for CVE-2023-6290?
No, CVE-2023-6290 can still be exploited even if unfiltered_html is disallowed for users.