CVE-2024-1134: SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO title and description parameters as well as others in all versions up to, and including, 7.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1134?
CVE-2024-1134 is rated as a high-severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-1134?
To fix CVE-2024-1134, upgrade the SEOPress plugin to version 7.5.2.2 or later, where the input sanitization and output escaping issues have been resolved.
What versions of SEOPress are affected by CVE-2024-1134?
CVE-2024-1134 affects all versions of SEOPress up to and including 7.5.2.1.
Can CVE-2024-1134 affect the security of my website?
Yes, CVE-2024-1134 can compromise website security by allowing attackers to execute malicious scripts on user browsers.
What are the attack vectors for CVE-2024-1134?
Attack vectors for CVE-2024-1134 include exploiting vulnerabilities in the SEO title and description parameters due to poor input handling.